# Polyot hosting

> Hosting for small businesses in Portugal. Every client has sites (static
> uploads, Git builds, Docker images, WordPress, dev boxes) on a small
> Kubernetes cluster. This file tells a language model how to read an account
> and how to make and deploy sites in it, and what each plan costs.
> Human-readable docs: https://polyot.net/docs

## Plans and pricing

Prices are per month, in euros, with no minimum term. Every plan has TLS, deploys
from Git and the inbox. Full table: /hosting; sign up: /checkout?plan={id}
(ids: free, basic, managed, container).

### Free - free, for good

- 1 site, 128 MB memory reserved, 1 GB storage, 0.25 CPU cores, up to 3 Mbit/s
- Scheduled jobs: none; site sizes: small
- Has: TLS certificate, deploy from Git or upload a folder, a polyot subdomain, status page, email support
- Has not: WordPress or any server code (static sites only: a folder, Astro, Vite, Hugo, Eleventy), databases, backups, custom domains, add-ons

### Website - €4 a month

- 3 sites, 512 MB memory reserved, 5 GB storage, 0.5 CPU cores, up to 6 Mbit/s
- Scheduled jobs: 2, 10 hours a month in all; site sizes: small
- Has: any template including WordPress and Docker, databases, nightly backups, custom domains, email support
- Has not: updates done for you, dev boxes, shell and private network

### Server - €8 a month

- 5 sites, 2 GB memory reserved, 40 GB storage, 1 CPU core, up to 8 Mbit/s
- Scheduled jobs: 5, 50 hours a month in all; site sizes: small, medium, large
- Has: dev boxes (Node, Python, PHP, Debian) with a shell in the browser, a disk that keeps /work, private network, any template, custom domains, email support
- Has not: updates done for you

### Managed - €12 a month

- 10 sites, 2 GB memory reserved, 25 GB storage, 1 CPU core, up to 10 Mbit/s
- Scheduled jobs: 5, 50 hours a month in all; site sizes: small, medium, large
- Has: we look after the sites: restore-tested backups, CMS and plugin updates done for you, 2 hours of direct support a month, any template, custom domains
- Has not: dev boxes, shell and private network

### Add-ons (paid plans only)

- Extra site: €2 a month per site, up to 20
- Storage: €5 a month per 10 GB, up to 20
- Memory: €5 a month per 1 GB reserved, up to 8
- Scheduled jobs: €2 a month per 5 jobs, 10 hours a month, up to 10
- Bandwidth: €2 a month per +2 Mbit/s, up to 2
- No account sends faster than 10 Mbit/s, whatever is added.

### Software we build for you

A €10 idea review, given back if we pass and taken off the bill if we build; the
build is quoted and paid half before, half on delivery. Afterwards: the code as a
Git repository, or Managed hosting at €10 a month, or Maintenance at
€35 a month (bugs fixed free, security updates, 2 hours of changes a month).

## Authentication

Everything below needs an API token, made at https://polyot.net/dashboard/tokens.

- Header: `Authorization: Bearer polyot_...` (any token)
- Or, for tools that can only open a URL: `?token=polyot_...` - accepted only
  on /api/llm paths and only for **read-only** tokens.

## Plain-text views (Markdown, made for you)

- https://polyot.net/api/llm - the account: plan, every site, its state and problems
- https://polyot.net/api/llm/sites/{name} - one site: containers, deploys, jobs, and its
  latest logs (`?lines=20..500`)

## JSON API (same data the dashboard uses)

- GET /api/apps - sites with live status
- GET /api/apps/{name} - one site
- GET /api/apps/{name}/logs?tail=300 - logs (`&source=build` for the last build)
- GET /api/apps/{name}/usage - CPU, memory, disk, traffic
- GET /api/plan - plan limits and what is used
- POST /api/apps/{name}/deploy - deploy: a Git site builds from its repository
- POST /api/apps/{name}/restart - restart (needs a full-access token)

## Making a site (full-access token)

Prefer a **template** whenever there is a repository: we write the Dockerfile
and rebuild from the repository on every deploy. Upload a folder only when
there is no repository.

- GET /api/platform/kinds - `templates`: every template id (astro, vite, hugo,
  eleventy, nextjs, nuxt, php, laravel, django, ...) with what it suits
- POST /api/apps - `{"name": "my-site", "spec": {"template": "astro", "repo": "https://github.com/you/site"}}`
  makes a site built from a repository. `{"name": "my-site", "kind": "static"}` makes
  one you upload a folder to: POST /api/apps/{name}/bundle with a .tar.gz of it as
  the body. A repository site: POST /api/apps/{name}/deploy.
- A private repository: POST /api/apps/{name}/deploy-key returns `publicKey`.
  Add it to the repository as a read-only deploy key (on GitHub:
  Settings > Deploy keys), then deploy. DELETE the same path removes it.
- A push does not deploy by itself: call deploy after pushing, or from CI.
- Build output: GET /api/apps/{name}/logs?source=build

The CLI does the same: `npx -y https://polyot.net/polyot-cli.tgz new my-site --template astro --repo URL`,
then `deploy my-site` (token in `POLYOT_TOKEN`). `templates` lists the
templates; `deploy-key my-site` makes a key.

## Inbox

Messages from email, contact forms, Telegram, Discord, Etsy, Vinted and any
API the client wires up, in one list.

- GET /api/inbox?channel=&kind=&unread=1&since=&before= - newest first
- POST /api/inbox/read - `{"ids": ["812"]}` or `{"all": true}`
- POST /api/inbox/connections/{id}/send - `{"to": senderId, "thread": thread, "text": "..."}`
  replies through that connection (full-access token): Telegram, Discord,
  email, contact forms (by email) and API connections. Etsy and Vinted cannot.

## Teams

An account can be a guest on other companies' teams, with the sites each one shares.

- GET /api/teams - every team this account is on: its own company first, then
  the ones it is a guest of, each with its people and what they may see
- GET /api/team - your own company's people and open invites
- PATCH /api/team/members/{id} - `{"access": "all"}` or `{"access": ["site", ...]}`
- DELETE /api/team/members/{id} - take someone off your team
- GET /api/teams/invites - invites waiting for you
- POST /api/teams/invites/{id} - `{"accept": true}` to join, anything else declines
- DELETE /api/teams/{company} - leave a team you are a guest of
- Sending an invite is done from the client area only.

A team's site: send `X-Polyot-Org: {company}` with any /api/apps call (or add
`?org={company}` to /api/llm paths). A guest cannot delete a team's site, touch
its domains, its billing or its team.

Writes need a full-access token in the Authorization header, never in the URL.
Secret values (environment variables, database passwords) are never shown here.