Hosting

Hosting builds and runs container backends or publishes static sites. Open Hosting in the project console.

You need permission on the project (apps.*, deployments.*, secrets.*, domains.*). End-user project JWTs cannot call hosting APIs.

App types

Type	What it is
Container	Source is built with Cloud Native Buildpacks and run on Kubernetes. Scale CPU, memory, replicas. Logs and metrics in the console.
Static	Files served from object storage via the platform static proxy. SPA index.html entry.

Default hostname looks like https://<slug>.apps.tefily.com. Bind a custom domain after the app exists.

Deploy sources

• Upload a source archive (presigned upload, then create a deployment)
• Link a Git repository and deploy a git ref
• Publish an already-built directory from a CI deploy-static step

Git deploy modes

Mode	Behavior
auto	Tracks the repo default branch, or gitDeployBranch if set. Pushes and merged MRs on that branch auto-deploy.
auto_branch	Tracks gitAutoDeployBranch (required). Same auto-deploy on that branch.
manual	Never auto-deploys. Call deploy-from-git with an explicit ref.

Optional gitDeploySubdirectory packages a monorepo subpath.

Archive upload

In the console: Hosting → the app → Deploy → Select Archive & Deploy.

Container apps:

1. POST /api/projects/:projectId/backend/apps/:appId/source-uploads. The body is optional: { "commitSha": "..." }.
2. The response includes uploadUrl, artifactKey, uploadSessionId, uploadToken, expiresInSeconds, and maxBytes.
3. PUT the archive to uploadUrl, then POST /api/projects/:projectId/backend/apps/:appId/deployments with sourceArtifactKey.

Static apps use the same two steps under /backend/static-apps/:appId/.

The archive ceiling is max_archive_bytes: 100 MB on Free, 500 MB on Pro, and 1 GB on Scale. That is the source archive, separate from the static-site size limit in Usage and limits.

Hostnames

On the app, bind a custom hostname, then verify it. The DNS page owns the record steps.

POST /api/projects/:projectId/backend/apps/:appId/hostnames
{ "hostname": "app.example.com" }

Then POST .../hostnames/:bindingId/verify and DELETE .../hostnames/:bindingId. The same handlers are mounted at .../domains. Static apps repeat this under /backend/static-apps/:appId/hostnames.

Secrets

Environment variables for container apps. Upsert by name; values are not shown again in list responses the same way as create. Import a batch from the console.

Replicas

PUT /api/projects/:projectId/backend/apps/:appId/scaling with minReplicas, maxReplicas, cpuMillis, and memoryMb. Permission is apps.scaling. Both replica fields are checked against max_replicas (Free 1, Pro 10, Scale 30). A new app starts at min 1 and max min(3, plan max), so Free is 1 and 1. CPU is capped at 500 / 4,000 / 8,000 millicores and memory at 512 / 8,192 / 16,384 MB (Free / Pro / Scale).

Rollback, logs, metrics

Each deployment has runtime logs, build logs, and a rollback action. Metrics are live snapshots plus time-range queries in the console.

Usage and limits

Hosting usage is metered per billing period; your plan includes an allowance for each meter and shows it on the organization Usage screen. When billing is enforced, a request past a hard limit fails with 429 quota_exceeded (or 402 payment_required when the account is suspended) and the console offers Upgrade plan.

Meter	What it measures
Replica hours	Ready replicas of your running container apps over time. An autoscaled app is billed for the replicas it actually runs; if the cluster cannot be read, its minimum replicas count. Stopped, suspended and static apps cost nothing.
Build minutes	Time a build job held a build slot, rounded up to whole minutes (minimum 1, capped at the build timeout). Successful, failed, timed-out and scan-blocked builds all count; a build that never started does not.
Storage	Source archives, build outputs (SBOM, provenance) and container images. Layers shared between image tags are counted once, and the build cache counts. Static-site files are not counted here.
Static storage	Files of your static sites, including superseded deployments until they are pruned.
Static bandwidth	Bytes served by your static sites, added up exactly (not rounded per request).
Custom domains	Bound hostnames, time-weighted over the period.

Housekeeping that keeps storage down. The 3 newest superseded static deployments are kept for rollback; older ones are deleted. For container apps the active deployment and the 5 newest others keep their source archive, SBOM, provenance and image; older ones are deleted by a daily sweep. A failed or blocked static upload leaves nothing behind.

Log retention. Runtime and build logs are readable for the plan’s window: 3 days on Free, 30 on Pro, 90 on Scale. Older entries are hidden, and stored build logs past the window are deleted. Static-site request metrics are kept for 14 days.

Plan fees and included quotas: Pricing.

Static bandwidth block. When a project has used its included static bandwidth and has no on-demand budget, the static proxy answers 402 for its sites until the next period or an upgrade. Usage reports are retried with an idempotency key, so a flaky network cannot double-bill.

Limits checked at write time. Replica count (min and max), secrets per app (Free 10, Pro 40, Scale 100), static site size per deployment (Free 50 MB, Pro 500 MB, Scale 2 GB), custom domains, and the storage allowance for new uploads.

MCP

create_hosting_app, update_hosting_git_source, deploy_from_git, upsert_secret. Prompts: deploy_backend_app, deploy_from_vesken_repo.