Tenant Platform Services: Project Plan #

The services a tenant can use beyond networks, workloads and names, one of three plans for the tenant platform with Tenant Fabric and Tenant Lifecycle.

Roadmap item: Tenant Platform Services

✓ 15 | ↻ 0 | ⏳ 4 (19 total)

Legend: ✅ Complete | 🔄 In Progress | ⏳ Planned

Platform services for tenants 🔄 #

What a tenant can declare today beyond networks, workloads and names, each through the provider.

✅ Wi-Fi keys: a PPSK key per tenant on DVNTM-IOT ( CHG-0013)
✅ Device registry ( CHG-0014)
✅ MQTT: VerneMQ, with broker accounts the API writes ( CHG-0015, CHG-0016)
✅ Logs: ingest and read tokens, and device logs over MQTT ( CHG-0020, CHG-0021)
✅ Dashboards: a Grafana organization per tenant ( CHG-0024)
✅ A tenant dev network, DVNTM-TD, reaching only the API, the state store, the broker, logs, Grafana and downloads ( CHG-0022)
✅ Tenant downloads: the prebuilt provider, a laptop check and the large installers, served on site ( CHG-0025)
⏳ Secrets, metrics and alerting, identity and object storage: designed, not built ( Coming Soon)
⏳ Device secrets in tenant code ( ADR-0033): the provider takes a tenant-supplied broker password and Wi-Fi key as write-only arguments, the restore path reads them from configuration, and eds and mabell move theirs from state into their repositories
⏳ Per-tenant resource quotas on the tenant hypervisor, so one tenant cannot use up the node
⏳ Workloads and DNS records come back after a rebuild: a reconcile re-ensures neither, and a tenant’s plain apply sees no change. Re-ensure them in the reconcile, or give the tenant a documented way to force a re-apply

Windows tenant laptops ✅ #

A tenant developer needs Terraform, the deevnet/deevnet provider and the grafana provider on their laptop, and a way to run the reference tenant’s targets. On Windows, that works two ways, natively in PowerShell or under WSL2, and the tenant guide documents both ( CHG-0058).

✅ Cross-compile the provider for Windows (amd64 and arm64), named .exe as Terraform requires, in make release-build and GoReleaser. Released in v0.9.0
✅ Install on Windows without bash: install-provider.ps1 into %APPDATA%\terraform.d\plugins, checked against SHA256SUMS, and tenant-check.ps1 with winget hints
✅ tenant-check.sh under WSL2: networking mode, a checkout on a Windows drive, the site’s names
✅ The reference tenant’s targets without make: tenant.ps1 in deevnet-tenant-tdemo, with the Makefile’s guards and a native state-backend
✅ LF line endings in a Windows checkout: .gitattributes in the provider and tdemo
✅ Mirror Terraform, the grafana provider and Pi Imager for Windows in the tenant downloads, with provider v0.9.0 and the .ps1 scripts. Served
✅ Before You Start and the other tenant pages gain the Windows lines and a Working from Windows section
✅ Proven from a Windows laptop on DVNTM-TD, natively (Windows PowerShell 5.1 and PowerShell 7) and under WSL2, on 2026-11-07