CubePath

Applies configuration changes to an already deployed balancer. It accepts several at once and each field triggers a different operation: `name` and `label` rename it, `project_id` moves it to another project of the same organization (regrouping only, no service interruption), `protected` turns the delete lock on or off, and `plan_name` resizes it. Careful with `plan_name`: it changes the billing and reboots the machine, so confirm it with the user and send it in a separate call, because it leaves an operation in flight that would block the rest of the changes. Changes are applied in order and independently: if one fails, the previous ones have already been saved. The balancer must be in state 'active' or 'stopped': while it is deploying or resizing, changes are rejected. The identifiers (the balancer UUID and those of its listeners and targets) come from `cubepath_lb_list`, which returns the full configuration of every balancer: call it first, do not make them up.

cubepath_lb_update

Moves a server to another resource plan, to get more CPU, RAM or disk, or to go down and save money. It changes billing, confirm with the user. The disk cannot be shrunk, so moving to a plan with less storage is rejected. The server restarts during the change. Use cubepath_vps_plan_list to get a valid plan_name in its location.

cubepath_vps_resize

Sets a new password for the server's administrator user. The change is applied within a few minutes and the previous password stops working. Use it when the user has lost access or wants to rotate credentials. Do not make the password up: ask the user for it.

cubepath_vps_change_password

Returns the video transcoding jobs with their status, progress and the files already generated. Use it to know whether a video finished converting, how much is left or why it failed. With `job_uuid` it returns only that job (including the list of output files and the destination they are written to); with `batch_id` it filters the jobs of a batch submission. The customer's storage credentials are never returned.

cubepath_transcoder_job_list

Creates or replaces the health check of an A or AAAA record (one per record). While the target is failing, that value is withdrawn from the DNS answers and comes back once it recovers: this is how to get automatic failover between several IPs of the same name. It requires the DNS Pro or Business plan and is billed at $10/month per check, so confirm with the user before creating a new one. Careful: it replaces the whole configuration, so send the fields that are not changing as well.

cubepath_dns_health_check_set

Sets or clears the reverse DNS (PTR record) of a floating IP, which is what a reverse lookup of that address returns. Use it when the user sets up a mail server or needs the IP to identify itself with a specific name. Omit `hostname` to clear the PTR. The IP has to be assigned to a server. The change propagates in the background.

cubepath_floating_ip_reverse_dns_set

Connects a server to a private network of the organization and assigns it an internal IP. Use it so that several servers talk to each other without going out to the Internet. The server has to be restarted for the change to take effect: warn the user. A server can only be in one private network at a time. Get the network_id with cubepath_project_list.

cubepath_vps_network_attach

With action='attach' it connects a dedicated server to a private network of the organization and assigns it an internal IP, adding the VLAN to the machine's switch port: use it so that it talks to other servers without going out to the Internet. A server can only be in one private network at a time, the network must be in its same location and the server must have switch ports assigned. With action='detach' it takes it out of the network and releases its internal IP, so any service that depended on that IP stops working: warn the user. In both cases the interface has to be configured inside the operating system for the change to take effect. Get the network_id with cubepath_project_list.

cubepath_baremetal_network

Opens a dynamic routing (eBGP) session between the private network's gateway and a server of the user's, so both exchange routes automatically instead of maintaining them by hand. Use it when the user talks about BGP, about announcing prefixes or about connecting an on-premise network over VPN. Maximum 8 sessions per network and only one session per neighbour. The network has to have a server attached already: on an empty network the gateway does not exist yet and the session would never come up. The network identifier comes from `cubepath_project_list`, which returns the networks of each project: no tool lists networks on its own.

cubepath_network_bgp_peer_create

Creates a CDN zone. The zone starts with no origins: it serves nothing until you add at least one with cubepath_cdn_origin_set. It is published at '{name}.cubecdn.io' (SSL for that domain is already in place); to serve it under a custom domain pass `custom_domain` and then point a CNAME from that domain to the system one. It is a billable resource: it charges the plan's hourly rate plus the traffic served, so confirm the plan with the user. Check the plans with cubepath_cdn_zone_list(include_plans=true).

cubepath_cdn_zone_create

Adds a record to a zone: point a domain or subdomain at an IP (A/AAAA), at another name (CNAME), set up mail (MX), verifications and SPF/DKIM (TXT), and so on. Use '@' in `name` for the root domain. If the zone is not verified yet the record is stored but not published until it is. SOA records and the root domain's NS records are managed by the system and get rejected.

cubepath_dns_record_create

Registers a domain in CubePath's DNS. The zone starts empty and in 'pending_verification' state: until the domain's nameservers point at CubePath's and it gets verified, records are stored but not published. Use it when the user wants to host a domain here. Hosting zones is free. Afterwards, add records and call cubepath_dns_zone_verify.

cubepath_dns_zone_create

Deploys a managed Kubernetes cluster: CubePath operates the control plane and the workers run as billable VPS of the organization. This is an expensive and asynchronous operation: the workers are provisioned in the background and the cluster is born in state 'provisioning'. Confirm the plan, the number of workers and the location with the user before calling it, because it starts billing as soon as the VPS exist. Resolve `version` and the `plan` of each pool with cubepath_k8s_catalog beforehand. Afterwards check cubepath_k8s_cluster_get to see when it turns 'active'; do not retry the creation.

cubepath_k8s_cluster_create

Deploys a NAT gateway on top of a private network so the servers of that network reach the Internet without having a public IP of their own. Use it when the user wants to give egress to isolated machines, or to unify the outbound IP of a group of servers. This is billed hourly and consumes one public IPv4 and one public IPv6: check `cubepath_nat_list` with `include_plans` as true first to pick a valid `plan_name`, and confirm with the user. Only one gateway fits per private network, and the deployment is queued and returns immediately with status 'deploying': follow the progress with `cubepath_nat_list`, do not repeat the call. The network's default route is created and maintained by the platform; there is no need to add it by hand. The UUID of the gateway comes from `cubepath_nat_list`, and the identifier of the private network from `cubepath_project_list`: resolve them before calling, do not make them up.

cubepath_nat_create

Deploys a new VPS server inside a project. It is a billable operation: check cubepath_vps_plan_list and cubepath_vps_template_list first to pick a valid plan, location and image, and confirm with the user before calling it. The deployment is queued and returns right away: check cubepath_vps_list to follow the status, do not repeat the call. If you disable both ipv4 and ipv6 the server is created without a public IP and needs a private network.

cubepath_vps_create

Deploys a new load balancer inside a project. This is billed hourly: check `cubepath_lb_plan_list` first to pick a valid plan and location, and confirm with the user. The deployment is queued and the tool returns immediately with status 'deploying': follow the progress with `cubepath_lb_list`, do not repeat the call. The balancer is born empty and balances nothing until you create a listener for it with `cubepath_lb_listener` and add servers with `cubepath_lb_target`.

cubepath_lb_create

Creates inside an instance either a logical database (object_type='database') or an access account (object_type='user'). This is what to use to give an application access: instead of handing out the admin account, a dedicated user is created. The platform reapplies them after every lifecycle event (failover, restart, scaling). When creating a user, `password` must be given explicitly: this channel never returns passwords, so one generated by the server would be lost and the user would be unusable. Valkey has no logical databases.

cubepath_mdb_object_create

Deploys a managed database (MySQL, PostgreSQL or Valkey) with high availability, automatic failover and a public connection endpoint: CubePath operates the whole infrastructure. It is a billable resource, charged per hour and per node, so confirm the plan and the replica count with the user before calling it. Pick the plan_uuid with cubepath_mdb_plan_list, because each plan is pinned to a location and an engine. The deployment takes several minutes: the tool returns as soon as it is queued and the status is followed with cubepath_mdb_list, not by retrying the creation.

cubepath_mdb_create

Starts an immediate backup of a server. Use it before a risky operation (reinstalling, changing plan, a big upgrade) or when the user asks for it. The backup is queued and takes a while: follow its progress with cubepath_vps_backup_list instead of repeating the call.

cubepath_vps_backup_create

Adds a new group of workers to a cluster that is already active. Use it when the user wants nodes with a different plan (more CPU or RAM), or a group kept apart by labels and taints for different workloads. The workers are billable VPS and are provisioned in the background. To add more nodes to a pool that already exists do not create another pool: use cubepath_k8s_node_pool_update. The `plan` has to come from cubepath_k8s_catalog with catalog='plans'.

cubepath_k8s_node_pool_create

Creates an isolated private network inside a project so that the project's servers can talk to each other over private IP. Use it when the user wants to separate internal traffic or build a multi-tier architecture. It needs the project identifier and the location name: get both from `cubepath_project_list` before calling. Each organization has its own limit on the number of networks (3 by default) and the call fails once it is reached. The network starts empty: attaching servers is a separate step.

cubepath_network_create

Creates an empty project to group servers and networks under. Use it when the user wants to separate environments or clients. It creates no resource inside: the project starts empty.

cubepath_project_create

Adds a static route that sends the traffic of a CIDR range to a next hop inside the private network: an IP, a VPS or a dedicated server. Use it when the user wants to push traffic through an appliance, a firewall or their own VPN, or to give Internet egress through a NAT server. Maximum 30 routes per network. The destination cannot be the network's own range, which is already routed, nor a reserved range (loopback, link-local, multicast), and its address family has to match the next hop's. The network identifier comes from `cubepath_project_list`, which returns the networks of each project: no tool lists networks on its own.

cubepath_network_route_create

Queues the conversion of ONE video and leaves the resulting files in the user's bucket. The input is either a public URL (`input_url`) or an object in their bucket (`input_s3`): exactly one of the two. `outputs` describes what to generate (one or several formats at once). The bucket credentials have to be provided by the user; do not make them up or guess them. The conversion takes time: the tool returns as soon as it queues, and the progress is checked with cubepath_transcoder_job_list, not by repeating this call. Pass `idempotency_key` if you are retrying a submission: with the same key it returns the job that already existed instead of duplicating it.

cubepath_transcoder_job_create

Creates an S3 compatible bucket. It is a billable resource: storage, egress and requests are charged by the hour beyond the free allowance, so confirm the tier and the name with the user. Names are global across all CubePath customers (3 to 63 lowercase letters, digits and hyphens). The bucket is `pending` for 10 to 20 seconds, then `active` (cubepath_wait_for_status with resource_type object_storage_bucket waits for it). To use it the user needs an access key, which is created from the panel, the API or cubecli, never from here.

cubepath_object_storage_bucket_create

Creates an availability group in a project. The servers you put in it are spread across different physical hosts, so that the failure of one host does not take the whole service down. Use it before deploying several servers that have to survive that outage together. The group is tied to a location and only accepts servers in that same location: take a valid location_name from cubepath_vps_plan_list. Creating it costs nothing.

cubepath_vps_availability_group_create

Manages the firewall rules the DDoS filtering applies to a protected IP: creates a rule, deletes a specific one by its identifier, or bulk-deletes every rule of a subnet matching a protocol and a port. Use it to open or close a port at the mitigation layer, to enable an application-specific protection (FiveM, RDP, DNS, Minecraft, TLS) or to set a rate limit per source IP. A rule that drops traffic cuts the service on that port immediately, and the bulk delete can leave a whole subnet unprotected: confirm with the user before calling it. Maximum 20 rules per IP. When creating on a subnet the rule is replicated on every IP of the block (IPv4 only and a /24 or more specific prefix). The identifier of an existing rule comes from `cubepath_ddos_protection_get`. Write the IP or subnet exactly as `cubepath_ddos_ip_list` returns it: a single IP with no mask ('185.20.30.40') or a subnet in CIDR notation ('185.20.30.0/24'). Only IPs of the organization with Premium protection are valid; those with Basic protection do not show up there and are rejected with 403.

cubepath_ddos_firewall_rule_edit

Creates a new Cloud Alert or edits an existing one. Without `alert_id` it creates, and then `project_id`, `name`, `target_type`, `target_id`, `metric`, `operator`, `threshold` and `channel_ids` are required. With `alert_id` it updates and only the fields you send are touched. Use it also to enable or disable an alert without deleting it (`status`). Resolve the server id first with cubepath_project_list and the channel ids with cubepath_alert_list. The alert fires when the metric meets the condition for `duration_seconds` in a row, and does not notify again until `cooldown_seconds` have passed. Careful: not every metric is valid for every target ({'vps': ['cpu', 'disk', 'network_in', 'network_out', 'ram'], 'baremetal': ['network_in', 'network_out'], 'availability_group': ['cpu', 'disk', 'network_in', 'network_out', 'ram']}). Maximum 20 alerts per organization.

cubepath_alert_set

Creates a firewall rule group or changes an existing one. Without `group_id` it creates, and then `project_id`, `name` and `rules` are required; with `group_id` it only edits what you send. `rules` REPLACES the whole list, so read the group first with cubepath_firewall_group_list and send the unchanged rules as well. When editing a group that is already applied, the changes sync themselves to the servers using it. Careful: leaving inbound port 22 out can lock the user out of SSH.

cubepath_firewall_group_set

Creates or edits the channel Cloud Alerts send their notifications to. Without `channel_id` it creates, and then `name` and `type` are required; with `channel_id` it only edits what you send. Type 'email' notifies the account's address and takes no configuration; 'slack' and 'discord' need the channel's incoming webhook URL, which the user has to provide. Use `enabled` = false to silence a channel without deleting it. Maximum 5 channels per organization. When read back, the webhook URL appears masked on purpose.

cubepath_alert_channel_set

Configures where the CDN pulls the content from. Without `origin_uuid` it creates a new origin; with `origin_uuid` it updates the existing one and only changes the fields you send. The easiest way is to pass the full `origin_url` (e.g. https://s3.eu-central-2.wasabisys.com/my-bucket/): address, port, protocol, Host header and base path are derived from it. A zone can have several origins with weights and priorities, and one marked as backup. For private S3 buckets at another provider (AWS, Wasabi, R2, Backblaze) enable `s3_auth_enabled` and pass the credentials: the edge signs every request with SigV4. To publish one of the user's CubePath Object Storage buckets (the only way to serve a bucket publicly), create the origin with `name` and `object_storage_bucket_uuid` and nothing else: the connection is configured from the bucket and the origin starts serving a few seconds later. That needs the object_storage:write scope as well, one CDN origin per bucket; delete the origin with cubepath_cdn_origin_delete to stop serving the bucket. A zone's current origins are visible through cubepath_cdn_zone_list by passing its `zone_uuid`.

cubepath_cdn_origin_set

Creates or updates a rule of the zone. Without `rule_uuid` it creates a new one and `rule_type` plus `action_config` are required; with `rule_uuid` it updates the existing one and only changes what you send (the type cannot be changed: delete and create). Use it to cache specific paths with their TTL (rule_type 'cache'), bypass the cache ('cache_bypass'), redirect ('redirect'), add headers ('header_request'/'header_response'), or block and throttle traffic: by IP, country or user-agent, with a rate limit, with a JavaScript challenge or with caps on speed, requests, connections and monthly bandwidth. `match_conditions` narrows which requests it applies to and `priority` decides the order (lower goes first).

cubepath_cdn_rule_set

Queues the conversion of SEVERAL videos at once, all with the same `outputs` and the same destination. Use it when the user wants to process a folder or a whole library instead of a single video. Each element of `inputs` is a public URL or a key inside the bucket of `input_defaults_s3` (so the credentials are given only once). `out_subpath` hangs that element's output off the common prefix. It returns a `batch_id`: follow the whole batch with cubepath_transcoder_job_list filtering by it, not by calling here again.

cubepath_transcoder_job_create_batch

Deletes a BGP session from a private network. The routes learned from that neighbour disappear and the traffic that depended on them stops flowing, so confirm with the user before calling it. If the point is only to bring the session down for a while, `cubepath_network_bgp_peer_update` with `enabled` set to false is better, since it keeps the configuration. The peer identifier comes from `cubepath_network_bgp_peer_list`. The network identifier comes from `cubepath_project_list`, which returns the networks of each project: no tool lists networks on its own.

cubepath_network_bgp_peer_delete

Removes an origin from the zone. If it was the only one, the zone is left with nothing to serve and starts returning errors: confirm with the user. To take it out of rotation without losing the configuration use cubepath_cdn_origin_set with `enabled` set to false. Deleting the origin of an Object Storage bucket also revokes the CDN's access to that bucket, which stops being served. Resolve the UUID first with cubepath_cdn_zone_list.

cubepath_cdn_origin_delete

Deletes a rule from the zone. The behavior it enforced (cache, redirect, block or limit) disappears as soon as it propagates and cannot be undone. If you only want to pause it, use cubepath_cdn_rule_set with `enabled` set to false. Resolve the UUID first with cubepath_cdn_rule_list.

cubepath_cdn_rule_delete

Deletes a CDN zone along with its origins and rules. The content stops being served through the CDN and it cannot be undone: domains pointing there stop responding. Confirm with the user before calling it. There is no soft delete to stop the charges while keeping the configuration: consider disabling the origins with cubepath_cdn_origin_set instead.

cubepath_cdn_zone_delete

Deletes a Cloud Alert together with its history. It stops watching and notifying immediately and cannot be undone. Confirm with the user before calling it. If they only want to silence it for a while, do not delete it: disable it with cubepath_alert_set and `status` = disabled.

cubepath_alert_delete

Removes a record from the zone. The name stops resolving to that value as soon as the TTL expires and it cannot be undone. Confirm with the user and resolve the UUID first with cubepath_dns_record_list, above all when several records share the same name.

cubepath_dns_record_delete

Removes the domain from CubePath's DNS along with ALL its records. It is irreversible and the domain stops resolving through these nameservers as soon as it propagates. Confirm with the user before calling it. To stop serving a single name do not delete the zone: delete that record with cubepath_dns_record_delete.

cubepath_dns_zone_delete