Salaam.

Your fleet across sovereign regions — compute, AI, and storage on a fully independent, screened supply chain.

–

clusters

–

nodes

–

buckets

–

object storage

–

tokens served

–

est. monthly cost

Inference throughput — tokens/min

Fleet node CPU — average %

Regions & provenance

Compute

CNCF-conformant Kubernetes across vetted providers. One API — pick jurisdiction and provider per cluster, move between them freely.

Cluster	Provider	Region	Nodes	CPU now	Mem now	Status	kubectl
Loading…

Apps

Point at a git repo, get a URL — no manifests. Dockerfile, Nixpacks, or static site; every push can redeploy via webhook, and every app serves on its own hostname with TLS.

App	Account	Cluster	Kind	URL
Loading…

New app from Git

Builds run on the platform (Dockerfile, else Nixpacks, else static) and meter per requested vCPU/GiB-hour onto your statement. CLI: shebaka deploy --git <url>.

AI Cloud

Serve open-weight models on an OpenAI-compatible API, or reserve dedicated GPU capacity — screened supply chain included.

Serving endpoints

Endpoint	Model	Status	Tokens served	Throughput	KV cache	In flight
Loading…

Playground

Responses stream token-by-token from the inference region — the same API customers integrate against.

Integrate — OpenAI-compatible

curl http://localhost:8090/v1/chat/completions \
  -H 'Content-Type: application/json' \
  -d '{"messages":[{"role":"user","content":"salaam"}],
       "stream": true}'

Existing OpenAI SDKs work by changing the base URL. Per-token metering feeds Billing automatically. Production serves vLLM on dedicated GPU pools — same endpoint, same SDKs.

Queues — live from Kueue on hetzner/fsn1

Queue	Scheduler	Quota	Admitted	Pending
Querying Kueue…

Fine-tune jobs

Job	Queue	Status	Submitted	Duration
No jobs yet — submit one.

Jobs are real Kubernetes Jobs admitted by Kueue against the queue's quota — submit several and watch them queue. In production the quotas are GPU flavors (H100, L40S, MIG) and the same scheduler does gang admission and topology-aware placement.

Object storage

S3-compatible, erasure-coded, replicated across the jurisdictions you choose. Existing SDKs and tools work unchanged.

Bucket	Region	Objects	Size	ID
Loading…

Connect

aws --endpoint-url http://127.0.0.1:3900 \
    --region hel1 s3 ls s3://ummah-assets/

# any S3 SDK:
endpoint  = http://127.0.0.1:3900
region    = hel1

Credentials live in ~/.shebaka/config.json. Production adds per-tenant keys, bucket policies, and cross-region replication targets.

Networking

Regions join over an encrypted WireGuard mesh; workloads publish through per-region load balancers.

Load balancers

Cluster	Namespace	Service	Port
Loading…

Management mesh

● Control plane ⇄ hetzner/fsn1 — encrypted (WireGuard)

● Control plane ⇄ scaleway/par1 — encrypted (WireGuard)

● Control plane ⇄ hel1 storage — encrypted (WireGuard)

Heterogeneous data centers join the fleet without complex peering. If the mesh drops, regional data planes keep serving — reconciliation pauses, traffic doesn't.

Observability

Prometheus and OpenCost run in every region, out of the box. No agents to install, nothing to wire up.

Node CPU by region — %

Node memory by region — %

Workloads

Namespace	Pod	Status	CPU	Memory
Select a cluster

Tenants

Customers on the platform — each isolated on dedicated clusters and networks, metered per node-hour, GB-month, and token against prepaid credit.

–

tenants

–

metered tokens

–

revenue, month to date

–

prepaid credit outstanding

Tenant	Plan	Clusters	Buckets	Tokens	MTD	Credit left
Loading…

Invoice

Select a tenant to preview its month-to-date invoice.

Isolation model

✓ One cluster per tenant — no shared kernel, no shared CNI, its own network segment (demo: per-cluster docker network; production: per-tenant VPC/VLAN + WireGuard)

✓ Default-deny NetworkPolicies inside each tenant namespace — only declared flows pass

✓ Per-tenant S3 access keys, scoped to the tenant's buckets only

✓ Per-tenant API keys on the inference endpoint — usage attributes to the payer, nothing is pooled

Billing

Metered from live infrastructure — cost allocation by OpenCost in every cluster, apps per resource-hour, storage and tokens from the platform. Statements close monthly; credit balance applies first, the remainder charges your card.

When	Amount	Source	Ref	Note
No credit movements yet.

–

est. month total

–

compute

–

storage

–

inference

Cost allocation by namespace — last 24h OpenCost

Cluster	Namespace	Cost (24h)
Querying OpenCost…

Platform lines — month estimate

Trust & sourcing

Every region's provenance is public: who owns the facility, where it sits, what powers it. This page is the product no hyperscaler can copy.

The screen — applied before onboarding, re-audited annually

✓ Ultimate beneficial ownership verified; no divestment-listed entities

✓ Upstream audit — capacity provenance verified to the facility level, no undisclosed resale

✓ Energy mix, PUE, and water usage disclosed; renewable-heavy grids weighted in placement

✓ Labor-practice screening for facility and operations staff

✓ Contractual exit & egress rights — failing re-audit means divestment, not a shrug