Overview
Luca IoT Cloud is a managed-hosting product I have been building from April 2025 to the present. It lets engineers and teams run the IoT tools they rely on — Node-RED, InfluxDB, and Grafana — without managing servers, Docker, TLS, or backups themselves.
The product has two halves working together:
- A control plane and node agent (the platform) that provisions and operates each customer instance.
- A bilingual marketing storefront where visitors browse services, compare plans, and get started.
Architecture
A central control plane (Next.js) handles authentication, the dashboard, and the business logic. It talks to a lightweight node agent (Fastify) over a private network; the agent is the only component that touches Docker, and it is never exposed to the public internet.
Each customer instance runs as its own Docker Compose stack behind a reverse proxy, reachable over an outbound-only Cloudflare Tunnel — so the host needs no open inbound ports. Platform state, accounts, and backup metadata live in Supabase (Postgres), and backup archives are stored in object storage.
Cloudflare edge → Tunnel → Traefik → Service instance
Control plane
Next.js app for auth, dashboard, and orchestration logic; never trusts the client — every action is re-checked server-side.
Node agent
Fastify service on each host, reachable only on a private network; the single component that drives Docker.
Provisioning
Renders a Docker Compose stack per instance with the right image, resource limits, and a branded login gate.
Data & storage
Supabase (Postgres) for accounts and instance state; object storage for backup archives.
Self-Service Provisioning
The storefront offers managed hosting for three services, each with public plan tiers and clear resource limits:
- Node-RED — Starter, Hobby, Start Up, Unicorn (1 vCPU / 1 GB up to 4 vCPU / 8 GB).
- InfluxDB — time-series storage tuned for high write throughput.
- Grafana — dashboards with a per-plan plugin allowance.
When a user creates an instance, the platform renders a dedicated container stack, applies the plan's CPU/RAM/disk limits, and fronts it with a branded login gate so customers see a consistent Luca IoT experience instead of each tool's default login.
Reliability & Security
Reliability and safety are built into day-to-day operations:
- Automated backups archive each instance's data to object storage on a daily schedule, keeping a rolling set of recent restore points.
- Safe upgrades take a pre-upgrade backup, apply the new version, and automatically roll back if the instance fails to come up healthy — with an email alert to the operator and owner.
- Tenant isolation keeps every instance in its own container with strict resource limits.
- Defense in depth: server-side role checks on every mutation, database row-level security so users only ever see their own resources, and encrypted secrets at rest.
Bilingual Storefront
The public website is a fast single-page app in English and Vietnamese. It presents the hosting catalog, transparent pricing, IoT consulting services, and real case studies, with a clear path from browsing a plan to getting started.
Live: lucaiot.com. The customer control panel lives at app.lucaiot.com (login-gated).
Tech Highlights
Instance provisioning
Technical Implementation: Per-instance Docker Compose stacks rendered on demand with plan-based limits
Benefit: New isolated instances are live in minutes, fully self-service
Backups & upgrades
Technical Implementation: Scheduled backups to object storage; upgrades with pre-backup and automatic rollback
Benefit: Customer data is protected and version changes are low-risk
Isolation & access control
Technical Implementation: Per-tenant containers, database row-level security, server-side role checks
Benefit: Users only ever reach their own resources, even under attack
Networking
Technical Implementation: Outbound-only Cloudflare Tunnel + private control-plane-to-agent link
Benefit: No inbound ports on hosts; smaller attack surface
Bilingual storefront
Technical Implementation: React SPA with EN/VI content and locale-prefixed routes
Benefit: Reaches both local and international customers with transparent pricing
What the Platform Delivers
- Self-service provisioning — a user picks a service and plan, and an isolated instance is live in a couple of minutes, no manual setup.
- Reliable by default — automated daily backups and safe one-click upgrades that auto-roll back on failure.
- Strong tenant isolation — every instance runs in its own container with per-plan CPU, RAM, and disk limits.
- Bilingual storefront with transparent, public pricing for every hosting plan.
- Running in production at lucaiot.com (storefront) and app.lucaiot.com (control panel).