GPlatform Control
The upstream half: the authority GControl instances enrol into.
The service we run. It issues licences, carries the catalogue and the signed artifact store, escrows lockdown keys, drives the support workflow, and manages the cloud deployments. GControl is the half you run; this is the half we do.
The other half
GPlatform Control is the half we run. GControl is the broker you run on your own infrastructure, and the two are licensed and governed separately.
What it is
The upstream authority behind the G-App line, and the thing a GControl instance enrols into.
It is the single source of truth for both sides of the licensing model: licence issuance, the app catalogue, the signed artifact store, lockdown key escrow, the support workflow, and the management plane for the applications we host directly.
Three surfaces, three doors
The web application carries three, each on its own path and behind its own door.
Staff manage the catalogue, artefacts, releases, accounts, API tokens and the audit log, and adopt instances.
The customer portal is where an organisation sees its own instances, its licences and their downloads, its applications, its access settings and its support conversations, and where an instance is paired.
Cloud is the management plane for the applications we host: their tenants, their deployments and their audit trail.
The dependency direction is one way
GControl contains no trace of the cloud. It consumes the published @ghub/* packages and never the reverse.
That is worth stating plainly, because it is the property that makes self-hosting real rather than nominal. If the self-hosted broker had to know about the cloud, the cloud could always be made load-bearing later. It cannot, because the code that would do it does not exist on that side.
Every call comes from the customer
There are no inbound connections into a customer network. A command is delivered as a field in the answer to a heartbeat the instance made, which is why an instance behind a firewall with no route in works exactly as well as one without.
What it holds that a customer would ask about
The private half of each instance's lockdown key, in Vault, so a sealed instance can be recovered — and never the material in the database, which holds the public half and a path.
The audit and stamp chain heads its instances anchor, which prove a chain has not been rewritten without disclosing what is in it.
Health samples for 90 days, meter aggregates as the usage record, and the licence record for as long as the licence and afterwards as the record of it.
Layout
The API is NestJS with zod-backed contracts and generated Swagger docs. A Temporal worker runs the parts that have to survive a restart: licence lifecycle, artifact publish, unseal, retention and cloud deploys. The web application is Next.js.
Status
Shipped alongside GControl, and the two move together.
Legal: Terms · Privacy notice · Processing agreement