Skip to content
Sencai.docs

Cloud infrastructure

Sencai is a control plane over cloud accounts - your own, or one Sencai provides. Once an account is connected, Sencai discovers what is running in it, and from then on you can inspect and operate that infrastructure from one place instead of one console per provider.

This page is a map of the section. If you are setting up for the first time, start at Connect a cloud provider.

Whose cloud account resources run on

Section titled “Whose cloud account resources run on”

Provisioning always happens on a cloud account with the provider - either a Sencai account, which Sencai owns and bills back to you with a fee on top, or your own provider account, connected with credentials you supply and billed directly to you. A Sencai account is the faster way to start; your own account keeps the billing relationship and the ability to walk away with your infrastructure intact entirely in your hands. See Sencai accounts and Connect a cloud provider for both paths.

The one distinction that matters

Section titled “The one distinction that matters”

Two different parts of the app look similar and do very different things. Getting them confused is the single easiest mistake to make here.

Live at the provider Records in Sencai
Menu Live Cloud → Firewalls at the provider; the Live at the provider view of Networks and the At the provider view of DNS The Networks in Sencai view of Networks, the Imported zones view of DNS, Policies, Templates
Acts on Your real provider account A record in Sencai’s database
Effect of a change Immediate, real, and billable Documents intent; changes nothing at the provider

So /gravity/live-cloud/firewalls opens a real firewall at your provider, while /gravity/networks/[id]/security-groups/[sgId] edits a Sencai row that describes one. Both are useful - the first for operating, the second for design and policy - but only one of them will lock you out of a server.

Networks and DNS each have one menu entry with a tab for each side, and the page says in a sentence which side you are on. Live write coverage differs per screen, so check the one you need rather than assuming:

Live screen Providers it writes to
DNS AWS, Azure, Google Cloud, Cloudflare, Hetzner Cloud
Firewalls Hetzner Cloud, AWS
Networks Hetzner Cloud

Only Hetzner has been verified end to end across all three. Providers outside a screen’s list appear in discovery and inventory, but that screen returns a “not implemented” error for them rather than failing as though it were an outage.

Where to start

Section titled “Where to start”
If you want to… Go to
Connect your first account Connect a cloud provider
Know what access to grant first Permissions your credentials need
See what you already run Import existing infrastructure
Create or operate a server Provision & manage instances
Deploy from a template Blueprints & the catalog

Operating what you have connected

Section titled “Operating what you have connected”

A sensible first hour

Section titled “A sensible first hour”
  1. Connect one account with read-only credentials.
  2. Run a discovery scan and look at what comes back.
  3. Adopt only the resources you actually want managed.
  4. Widen the credential to write access once you trust what you see.

Doing it in that order means the worst case of a misconfiguration is an incomplete inventory rather than an unintended change to production.

What’s next

Section titled “What’s next”