Dedicated hardware.
Your cluster. Your rules.

Private Kubernetes cluster

Your applications run in a private Kubernetes cluster provisioned exclusively on your hardware. No shared control plane, no shared node pools, no cross-tenant traffic.

Local NVMe storage

Storage is physically attached to your server. Not EBS. Not network-attached block storage with variable latency. NVMe SSDs connected directly to the motherboard — sub-0.1 ms I/O.

Dedicated network interface

Your cluster has its own dedicated network port — up to 10 Gbps, unshared. Bandwidth is not pooled with other tenants on the same physical switch.

No noisy neighbours — ever

Shared infrastructure means CPU contention, I/O interference, and network saturation from other tenants. On Aureus there are no other tenants on your hardware. Performance is yours entirely.

Zero-downtime deployments

Rolling deployments with pre-flight health checks and automatic rollback on failure. New replicas are warmed before traffic is cut over — no dropped requests.

Autoscaling

Horizontal and vertical scaling based on real CPU, memory, and request-rate telemetry. Scaling events are logged and reviewed — not treated as noise.

Continuous security patching

OS and runtime security patches applied on a defined schedule. Critical CVEs addressed within 48 hours. You are notified. No action required from your team.

Automatic TLS + custom domains

All applications get TLS certificates automatically. Custom domains are configured and renewed without manual intervention. Wildcard *.aureus.cx subdomains included.

Dependency and secrets scanning

Every deployment is scanned for known vulnerabilities and accidentally committed secrets before traffic reaches it. Findings block deployment until resolved.

Infrastructure reports

Monthly reports covering resource utilisation, deployment history, incident log, and recommendations for the coming period. Cluster M and L customers receive these as standard.

High-availability by default

Hot standby replicas keep a failover target synchronised at all times. Failover is automated — no manual intervention required during a hardware failure.

Continuous backup streaming

Write-ahead log segments are streamed to offsite object storage continuously. Point-in-time recovery to any moment within the retention window.

Immutable backup archives

Backup archives are written with object lock. They cannot be deleted or modified by application-layer processes — only by authorised expiry after the retention period.

24/7 monitoring and alerting

All clusters are monitored around the clock for availability, performance anomalies, and resource exhaustion. The Aureus on-call engineer is paged — not you.

Pre-launch security audit

No application goes live without a security review — OWASP top 10, dependency scanning, secrets detection, network exposure. Every deployment is reviewed before traffic hits it.

Network isolation per cluster

Each cluster runs in a private network namespace with no route to other customers' clusters. Kubernetes network policies enforce service-level traffic rules within your cluster.

IP allowlisting

Database and service ports can be restricted to specific IP ranges or CIDR blocks. Connections from addresses not on your allowlist are dropped at the network layer.

TOTP 2FA on all accounts

Dashboard accounts support TOTP two-factor authentication. Staff accounts require MFA. Session tokens are short-lived and invalidated on password change.

Scoped API keys

Programmatic access uses scoped API keys. Read-only keys cannot write. Write-scoped keys are namespaced to specific resource types. Keys revocable instantly.

Audit logging

All administrative actions — cluster access, configuration changes, deployments — are logged with timestamp, actor, and action. 90-day retention, available on request.

Live cluster metrics

Real-time CPU, memory, disk, and network usage — animated, per-resource, with colour-coded utilisation thresholds. Available from the cluster detail page.

Application registry

Register and manage every application on your cluster. Deployment notes, build packs, base directories, static site configuration, and auto-generated *.aureus.cx domains.

REST API

Manage clusters, applications, and tickets programmatically. Scoped API keys. Full documentation at /docs. Examples for curl, Node.js, and Python.

Team management

Invite engineers, assign roles, and manage access. Each team member gets a unique support PIN for instant phone-based verification during incidents.

Connection helpers

Every cluster has a Connect button that generates connection strings for your databases in URI, libpq, and JDBC formats — with masked credentials and one-click copy.

2FA on every account

TOTP-based two-factor authentication on every account. Supports Google Authenticator, 1Password, Authy, and any TOTP-compatible app. Email OTP as fallback.