TRC Sovereign Cloud — Dedicated AMD EPYC Enclaves & Push-to-Deploy PaaS

Hardware-Honest Enclave Tiers & Resource Guarantees

Unlike hyperscale clouds that meter every NAT gateway packet, IOPS spike, and serverless cold start, TRC Sovereign Cloud enforces hard Linux container CPU, memory, and process isolation boundaries on dedicated AMD EPYC NVMe infrastructure (US-East) with optional hard monthly spend caps.

Visual Container Canvas & Hub Variable Splicing

Inside the Sovereign Cloud Canvas (/cloud/canvas), every frontend, backend API, worker, PostgreSQL 16 instance, and Redis 7 cache appears as an interactive topology node with real-time CPU, RSS memory, network KB/s, disk, and PID telemetry.

When you wire a backend service to Postgres or Redis on the canvas, TRC resolves dynamic Hub references at container boot without ever writing raw credentials into your Git repository. Databases listen strictly on enclave loopback / private internal DNS (*.trc.internal) so port scanners cannot reach 5432 or 6379 from the public internet.

Hub Environment Wiring (.env)

# Declared in Sovereign Cloud -> Service -> Variables Vault (AES-256-GCM encrypted at rest)
NODE_ENV=production
PORT=3002

# Dynamic Hub Variable Splicing — resolved automatically from sibling enclave containers:
DATABASE_URL={{Postgres.DATABASE_URL}}
REDIS_URL={{Redis.REDIS_URL}}
PUBLIC_API_ORIGIN=https://{{Service.DOMAIN}}

# Unified TRC AI & Vault key for server-side inference
TRC_API_KEY=trc_live_your_scoped_server_key

GitHub Push-to-Deploy Flow

# 1. Connect your repository in /cloud -> Developer & GitHub Automation
#    Nixpacks auto-detects Node.js, Python, Go, Rust, or Dockerfile builds.

# 2. Push to your tracked production branch (or open a Pull Request for pr-<num>-app.trc.inc)
git push origin main

# 3. Enclave deployment pipeline executes automatically:
#    - Verifies HMAC-SHA256 GitHub webhook signature
#    - Builds immutable container image or static SPA bundle
#    - Runs /health readiness probe before atomic Caddy HTTP/3 upstream cutover
#    - Keeps prior immutable release warm for 1-click instant rollback

AES-256-GCM Secret Vaults, 6-Hour Backblaze B2 Backups & Two-Tree Survivor

Every service maintains its own isolated AES-256-GCM encrypted variable vault. Operators can trigger 1-click zero-downtime master key rotation from the Security tab, and every secret reveal or deployment action is recorded in an immutable audit log.

Every 6 hours, automated background jobs stream AES-256-GCM encrypted database and cache snapshots to Backblaze B2 object storage for point-in-time disaster recovery.

Two-Tree Survivor Architecture separates your application runtime tree from an independent, minimal hardware-key-authenticated recovery channel. Even if a bad application push exhausts container memory or misconfigures routing, your break-glass SSH and control-plane recovery channel remains reachable so you can never be locked out of your own enclave.

Frequently Asked Questions

Does Sovereign Cloud include pgvector for RAG and AI embeddings out of the box?

Yes. Provisioned PostgreSQL 16 instances include the pgvector extension pre-installed so you can run CREATE EXTENSION IF NOT EXISTS vector; and store HNSW or IVFFlat vector indexes alongside relational tables.

Can I host custom apex and wildcard domains with automatic HTTPS?

Yes. Point an A or CNAME record to your enclave ingress in the Domains panel (/cloud?section=domains), and Caddy automatically provisions and renews HTTP/3 (QUIC) + TLS 1.3 certificates.