Skip to content
Compute
// DOCS

Provider setup and activation

The selected supplier is OVHcloud only. Segal retains its own site, service interface and support relationship. No OVHcloud partner badge or activated resale relationship is claimed by this implementation.

Establish the account and resale scope

Review the OVHcloud Partner Program and obtain the commercial permission and service terms appropriate to the intended resale. OVHcloud’s startup guidance directs white-label resellers toward its partner program; that guidance is not itself approval for Segal’s account.

An EU API account is the default for this integration’s combined Public Cloud, domain, hosting and Email Pro scope. Canadian and US API endpoints are configurable, but product availability and account permissions differ. Do not assume a US account can supply the web, registrar and email products described here.

Activate application identity and storage

Configure AUTH_SECRET, DATABASE_URL, AUTH_GOOGLE_ID, AUTH_GOOGLE_SECRET and the production application URL. The existing application uses Google OAuth or its previously configured email identity provider; no new transactional-email reseller product is introduced.

The inspected production deployment had no environment variables configured on 24 October 2026. Login, database persistence and provider access therefore require application onboarding before the new infrastructure console can be exercised live.

Apply the reviewed Drizzle migrations to the application database with npm run db:migrate. Migration 0007_lively_vanisher.sql adds only the durable provider-operation table. Back up an existing database before a migration; do not replace financial or identity history with demo seeds.

Configure credentials securely

Create an application key, application secret and consumer key using the official OVHcloud API setup guide. Place them in the deployment’s server-side environment, never in chat, source control, client code or NEXT_PUBLIC_ variables:

  • OVH_ENDPOINT: ovh-eu by default; endpoint must match the credential’s account.
  • OVH_APPLICATION_KEY
  • OVH_APPLICATION_SECRET
  • OVH_CONSUMER_KEY
  • OVH_TENANT_BINDINGS_JSON

Use a consumer key restricted to the exact customer projects and allowed resource paths. Start with GET rights on the bound project, flavor, image, SSH-key, instance, AI, storage, Kubernetes, database, networking, DNS, hosting and mail paths that the selected service needs. Do not grant wildcard account administration, order-cart checkout or unrelated customer access.

When enabling supported configuration submissions, add only the required POST rights: project instances, volumes, private networks, Kubernetes clusters, regional storage buckets, authorized DNS records and DNS zone refresh. Instance start/stop rights are optional operational permissions. No automatic resource deletion or paid order checkout is implemented.

Bind customer organizations

Create one OVHcloud Public Cloud project per Segal organization. The binding object is keyed by the real Segal organization ID:

{
  "SEGAL_ORGANIZATION_UUID": {
    "projectId": "OVH_PUBLIC_CLOUD_PROJECT_ID",
    "regions": ["GRA11"],
    "domains": ["customer.example"],
    "hostingServices": [],
    "mailServices": [],
    "dedicatedServers": []
  }
}

The example region is a documented identifier, not a promise of customer eligibility or GPU capacity. Use project-specific enabled regions and real authorized service identifiers. Bindings must not overlap across organizations. Empty service allowlists intentionally expose no account-wide inventory.

Verify without provisioning

Run npm run provider:check -- SEGAL_ORGANIZATION_UUID with local server environment values configured securely. The check reports missing variable names and performs read-only project/catalog verification when possible. It never creates a VM, orders a domain, sends email or prints credentials.

Then sign in, select the bound organization and open its infrastructure workspace. Verify inventory, regional flavors, images and registered SSH keys. An explicit connection error must remain an error; do not substitute demonstration resources.

Enable supported writes deliberately

Keep both switches false until customer terms, pricing, support ownership, database migration, tenant mapping and quota are confirmed:

OVH_RESALE_CONFIRMED=false
OVH_WRITES_ENABLED=false

Set them true only after the operator has completed those requirements. These are operator assertions, not an automated verification of partner status. The request must also come from an organization owner or administrator and acknowledge applicable charges.

Provisioning creates provider resources and can incur charges. Stopping a Public Cloud instance retains its reserved resources and continues to incur the same instance charge. An accepted configuration is not evidence of application readiness. Reconcile uncertain request IDs before retrying.

Unsupported products and commercial claims

Mailbox hosting does not include transactional or bulk sending. OVHcloud documents this restriction in its email support guide. Hosting CDN and SSL are scoped to eligible plans; arbitrary edge functions, managed WireGuard, physical rack sales and guaranteed NVLink fabrics are excluded.

Do not restore the former seed GPU prices, fictional regions, fixed delivery dates or certification badges as production facts. Customer pricing and commitments require a verified service quote. Billing reconciliation and tax/invoice operations are separate from this infrastructure connector.

← Previous

Platform architecture

Next →

Billing & metering