Tenka Cloud

Platform Documentation & API Reference

Overview Architecture Apps Servers Terminal Server Linking Billing AI Proxy API Reference Admin

Overview

Tenka Cloud is a platform for deploying and managing cloud servers with pre-configured applications. It supports two cloud providers:

AWS EC2 instances in eu-north-1 (Stockholm)
Hetzner Cloud servers in multiple EU/US locations

Each server gets a subdomain (name.tenka.cloud), automatic SSL via Let's Encrypt, web terminal access, and an AI assistant (Claude Code) pre-installed.

Architecture

Stack

Backend: Python FastAPI, Uvicorn, SQLite
Frontend: Vanilla JS, single-page app
Reverse proxy: Nginx with SSL termination
SSH keys: RSA 4096-bit, encrypted at rest via AWS KMS
Databases: tenka.db (AWS + auth + billing), hetzner.db (Hetzner deployments)

Server Provisioning Flow

Generate RSA 4096 key pair
Register public key with cloud provider
Create firewall (ports 22, 80, 443)
Launch server with cloud-init script
Cloud-init installs software, configures Claude Code, sets up SSL
SSH key encrypted via KMS and stored in DB

Available Apps

App	Description	Providers
Claude Code	Development VM with Claude Code AI assistant, Node.js, nginx, tmux	Both
Basic Web Server	Nginx + Node.js ready-to-use web server	Both
Vaultwarden	Self-hosted Bitwarden-compatible password manager (Docker)	Both
n8n	Visual workflow automation platform (Docker)	Both

Apps define a cloud-init script that runs on first boot. Custom apps can be added via the API.

Server Management

Actions

Action	Description
Start / Stop	Power on/off the server (billing pauses when stopped)
Reboot	Restart the server OS
Resize	Change server type/size (requires stop first on some providers)
Delete	Permanently remove server and all data

Addons

Pre-built install scripts that can be applied to running servers via SSH:

Claude Code, Docker, Nextcloud, Nginx, Node.js, PostgreSQL, Redis, Vaultwarden

Web Terminal

Each running server has a web-based terminal accessible from the dashboard. Features:

Full xterm.js terminal with 256-color support
Image paste support (clipboard images uploaded to ~/app/data/)
Mobile keyboard bar with Ctrl, Alt, Esc, Tab, arrow keys
Special character menu (|, ~, `, \, {, }, [, ])
Auto-reconnect and resize handling

For Claude Code servers, the terminal auto-starts a tmux session with Claude running in ~/app/.

Server Linking

Link servers so they can SSH to each other. A link from Server A → Server B means A can ssh subdomain to reach B.

How it works

A's public key is added to B's authorized_keys
A's private key is written to ~/.ssh/tenka-link-{id}.key
A's ~/.ssh/config gets an entry: Host subdomain pointing to B's IP

File Copy

Linked servers can copy files between each other. The UI provides a two-panel directory browser with push/pull direction. Copies run as background rsync jobs with progress polling.

Billing

How costs are tracked

VM uptime: Tracked per-minute, costs calculated from provider rates
AI tokens: Proxy usage logged per request (input/output tokens, model, cost)
Daily aggregation: Costs rolled up into daily summaries

Hetzner Server Types

Type	vCPU	RAM	Disk
cx22	2	4 GB	40 GB
cx32	4	8 GB	80 GB
cx42	8	16 GB	160 GB
cx52	16	32 GB	320 GB
cx33	4	8 GB	80 GB

AI Proxy

Each deployment gets an AI proxy endpoint at https://dashboard.tenka.cloud/proxy/v1/.

Authentication

Authorization: Bearer tenka-{deployment_id}:{proxy_token}
# or
x-api-key: tenka-{deployment_id}:{proxy_token}

The proxy validates the token and checks that the request IP matches the deployment's public IP. Requests are forwarded to the Anthropic API.

Environment on servers

ANTHROPIC_API_KEY=tenka-{id}:{token}
ANTHROPIC_BASE_URL=https://dashboard.tenka.cloud/proxy/v1/

These are set in /etc/profile.d/claude-code.sh and /etc/environment.

API Reference

Base URL: https://dashboard.tenka.cloud

Authentication: Session cookie (Cookie: session={token})

Auth

Method	Path	Description
POST	`/api/auth/register`	Create account (email, password, name)
POST	`/api/auth/login`	Login, returns session cookie
POST	`/api/auth/logout`	Invalidate session
GET	`/api/auth/me`	Current user info

Apps

Method	Path	Description
GET	`/api/apps`	List all available apps
POST	`/api/apps`	Create app (admin)
PATCH	`/api/apps/{id}`	Update app settings (admin)

Deployments AWS

Method	Path	Description
GET	`/api/deployments`	List user's AWS deployments
POST	`/api/deployments`	Create AWS deployment
GET	`/api/deployments/{id}`	Get deployment detail
POST	`/api/deployments/{id}/start`	Start stopped server
POST	`/api/deployments/{id}/stop`	Stop running server
POST	`/api/deployments/{id}/reboot`	Reboot server
POST	`/api/deployments/{id}/resize`	Change instance type
POST	`/api/deployments/{id}/delete`	Delete server

Deployments Hetzner

Method	Path	Description
GET	`/api/hetzner/deployments`	List user's Hetzner deployments
POST	`/api/hetzner/deployments`	Create Hetzner deployment
GET	`/api/hetzner/deployments/{id}`	Get deployment detail
POST	`/api/hetzner/deployments/{id}/start`	Start stopped server
POST	`/api/hetzner/deployments/{id}/stop`	Stop running server
POST	`/api/hetzner/deployments/{id}/reboot`	Reboot server
POST	`/api/hetzner/deployments/{id}/resize`	Change server type
POST	`/api/hetzner/deployments/{id}/delete`	Delete server
POST	`/api/hetzner/deployments/{id}/repair-ssh`	Repair SSH key if auth fails

Unified

Method	Path	Description
GET	`/api/all-deployments`	List all deployments across providers

Server Links

Method	Path	Description
GET	`/api/server-links/{deployment_id}`	List links for a deployment
POST	`/api/server-links`	Create link (from_id, to_id)
DELETE	`/api/server-links/{link_id}`	Remove link
POST	`/api/server-links/{link_id}/copy`	Copy files between linked servers
GET	`/api/copy-status/{job_id}`	Poll copy job progress

File Browser

Method	Path	Description
GET	`/api/browse/{deployment_id}?path=/root`	List directory contents on server

Billing

Method	Path	Description
GET	`/api/billing/rates`	AWS instance rates
GET	`/api/billing/daily/{deployment_id}`	Daily costs for deployment
GET	`/api/billing/ai-usage`	AI token usage
GET	`/api/hetzner/billing/rates`	Hetzner server rates
GET	`/api/hetzner/billing/daily/{id}`	Hetzner daily costs

Admin

Method	Path	Description
GET	`/api/admin/users`	List all users
POST	`/api/admin/users/{id}/reset-password`	Reset user password
GET	`/api/billing/admin`	Billing summaries per user
GET	`/api/billing/admin/ai-usage`	AI usage across all users
GET	`/api/admin/guardduty`	AWS GuardDuty security findings

Terminal (WebSocket)

Protocol	Path	Description
WS	`/ws/terminal/{id}`	AWS server terminal
WS	`/ws/ssm-terminal/{id}`	AWS SSM terminal (no SSH key needed)
WS	`/ws/hetzner-terminal/{id}`	Hetzner server terminal

Admin Guide

Managing Apps

# Set initial prompt for an app
curl -X PATCH /api/apps/{app_id} \
  -H "Cookie: session=..." \
  -d '{"initial_prompt": "What would you like to build?"}'

# Update cloud-init script
curl -X PATCH /api/apps/{app_id} \
  -d '{"cloud_init_script": "#!/bin/bash\n..."}'

User Management

Admin users can view all users, reset passwords, and see billing across all accounts from the Admin page in the dashboard.

Monitoring

GuardDuty: AWS security findings shown in admin panel
Billing: Per-user cost summaries with VM hours and AI token usage
Logs: Uvicorn logs at /tmp/uvicorn*.log