Getting Started

I-NTER.NET is a managed cloud platform organized into three layers: Infrastructure (compute and storage primitives), Platform (observability, messaging, and access control), and Edge (TLS, DNS, and network policy). All services share a single private project network and a unified API.

Prerequisites

An I-NTER.NET account — create one at /console
The INET CLI installed (curl -sSL https://i-nter.net/install.sh | sh)
An API key generated from Console → IAM → Keys

Authenticate the CLI

inet auth login --key <your-api-key>

Create a project

All resources belong to a project. Projects provide network isolation, shared IAM, and unified billing.

inet projects create my-project inet projects use my-project

What to read next

Deploy your first function — see Functions
Store objects — see Buckets
Provision a machine — see Machines
Set up access control — see IAM

Core Concepts

Projects

A project is the top-level organizational unit. All resources — Machines, Buckets, Functions, secrets, firewall rules — belong to a project. Resources within a project share a private VLAN and can communicate without leaving the INET network. Billing, IAM, and logs are all scoped per project.

Regions

Resources are provisioned in a specific region. Intra-project traffic within a region is free; cross-region traffic is metered. Private DNS and VLAN isolation are per-region.

API

All platform operations are available via the INET REST API at https://api.i-nter.net/v1. Every request must include an Authorization: Bearer <key> header. The CLI is a thin wrapper around this API.

Events as the integration layer

Platform primitives emit events automatically — a Machine stopping, a Bucket object created, a Function invocation failing. These events flow into the Events service where you can subscribe Functions, webhooks, or other consumers. This means you rarely need custom polling or glue code to wire services together.

CLI Reference

The inet CLI provides subcommands for every service. Run inet <service> --help for full flag documentation.

Command	Description
`inet auth`	Authenticate, switch keys, and manage sessions
`inet projects`	Create, list, and switch projects
`inet fn`	Deploy, invoke, and manage Functions
`inet buckets`	Create buckets, upload/download objects
`inet machines`	Provision, SSH into, snapshot, and destroy Machines
`inet events`	Manage topics, subscriptions, and inspect delivery history
`inet logs`	Query and stream logs from any resource
`inet metrics`	Query time-series metrics
`inet iam`	Manage roles, service accounts, and API keys
`inet secrets`	Store, retrieve, rotate, and inject secrets
`inet tls`	View and manage certificates
`inet dns`	Manage zones and records
`inet firewall`	Manage rules and profiles

Functions Infrastructure

Functions run event-driven handlers without managing servers. INET provisions runtime capacity on demand, routes triggers to your handler, and bills only for active execution time. Instances scale to zero when idle.

Handler signature

Each runtime expects a specific handler shape. Examples:

// Go func Handler(ctx context.Context, event inet.Event) (inet.Response, error) # Python def handler(event: dict, context: Context) -> dict: // Node.js export async function handler(event, context) { }

Triggers

Trigger	Config	Notes
`http`	path, method, auth	Endpoint served over TLS; supports public and project-private access
`schedule`	cron expression	Minimum interval: 1 minute
`bucket`	bucket name, event type	Fires on `create`, `update`, `delete`
`machine`	machine id or tag	Fires on `start`, `stop`, `health_change`
`event`	topic, filter expression	Subscribe to any Events topic

Runtimes

Runtime	Identifier	Max memory	Max timeout
Go 1.22+	`go122`	4 GB	15 min
Node.js 22	`node22`	4 GB	15 min
Python 3.12	`python312`	4 GB	15 min
Rust (stable)	`rust-stable`	4 GB	15 min
Custom image	`container:<image>`	Configurable	60 min

Deploy

inet fn deploy \ --name my-handler \ --runtime go122 \ --trigger http \ --memory 256

Environment variables and secrets

Pass environment variables at deploy time with --env KEY=value. Inject secrets by name with --secret MY_SECRET — the value is mounted as an environment variable at runtime and never stored in your function config.

Limits

Property	Limit
Deployment package size	250 MB (zip), unlimited (container)
Concurrent executions per project	1,000 (soft limit, raiseable)
Max execution timeout	15 min (managed), 60 min (container)
Ephemeral disk (`/tmp`)	512 MB

Buckets Infrastructure

Buckets provide S3-compatible object storage. Any tool or SDK that speaks S3 works against INET Buckets without modification — point it at the INET endpoint and swap your credentials.

Create a bucket

inet buckets create my-bucket --region mia1 --access private

Upload and download objects

inet buckets cp ./file.tar.gz my-bucket/backups/file.tar.gz inet buckets cp my-bucket/backups/file.tar.gz ./file.tar.gz

Storage classes

Class	Retrieval	Use case
`standard`	Immediate	Application assets, user uploads, live datasets
`archive`	Minutes to hours	Backups, logs, compliance archives

Transition objects between classes automatically with lifecycle rules:

inet buckets lifecycle set my-bucket \ --transition-to archive \ --after-days 90

Access control

Buckets default to private. Access is controlled at three levels:

Bucket policy — public or private at the bucket level
IAM keys — scoped per project or per bucket; managed under IAM
Presigned URLs — time-limited access without exposing credentials

# Generate a presigned URL valid for 1 hour inet buckets presign my-bucket/object.pdf --expires 3600

S3 compatibility

Use any S3-compatible client. Set the endpoint to your region's object storage URL:

AWS_ENDPOINT_URL=https://s3.mia1.i-nter.net \ AWS_ACCESS_KEY_ID=<inet-key-id> \ AWS_SECRET_ACCESS_KEY=<inet-secret> \ aws s3 ls s3://my-bucket/

Versioning

Enable versioning to retain all previous versions of every object. Deletes and overwrites become non-destructive — prior versions are always recoverable.

inet buckets versioning enable my-bucket

Machines Infrastructure

Machines are on-demand virtual or bare metal instances. They are attached to your project's private VLAN at provision time and billed per second of active runtime. Stopped instances are not billed.

Instance types

Type	vCPU	Memory	Notes
`standard-1`	1 shared	1 GB	Dev, low-traffic workloads
`standard-2`	2 shared	4 GB	General purpose
`standard-4`	4 dedicated	8 GB	Production web and API
`standard-8`	8 dedicated	16 GB	High-throughput workers
`metal-1`	Full host	Varies	No hypervisor; latency-sensitive workloads
`gaming-*`	High clock	Varies	Pre-configured for game server hosting

Provision a machine

inet machines create \ --name web-1 \ --type standard-4 \ --image ubuntu-24.04 \ --region mia1 \ --ssh-key ~/.ssh/id_ed25519.pub

SSH access

inet machines ssh web-1 # or directly: ssh root@<machine-private-ip>

Snapshots

Capture the full disk state at any point. Snapshots are stored in the INET object layer and can be used to restore or clone a Machine.

inet machines snapshot create web-1 --name pre-deploy-20260401 inet machines snapshot restore web-1 --snapshot pre-deploy-20260401

Resize

Virtual instances can move between types without reprovisioning. The Machine is briefly stopped, resized, and restarted. Bare metal instances cannot be resized — provision a new host and migrate.

inet machines resize web-1 --type standard-8

Networking

Every Machine gets a stable private IP on your project VLAN. Public IPs are optional and can be attached or detached at any time. Firewall rules are configured separately under Firewall.

inet machines attach-ip web-1 --public

Events Platform

Events provides pub/sub messaging between services. Publishers push events to a topic; subscribers receive them with at-least-once delivery. INET handles retries, dead-letter queuing, and fan-out — no broker to manage.

Topics and subscriptions

# Create a topic inet events topics create order-placed # Subscribe a Function inet events subscriptions create \ --topic order-placed \ --target fn:process-order # Subscribe a webhook inet events subscriptions create \ --topic order-placed \ --target https://example.com/webhook \ --secret <signing-secret>

Publish an event

inet events publish order-placed \ --data '{"order_id": "abc123", "total": 4900}'

Platform events

Platform primitives emit events automatically to a reserved inet.* topic namespace. You cannot publish to these topics, but you can subscribe to them:

Topic	Emitted when
`inet.machines.started`	A Machine transitions to running
`inet.machines.stopped`	A Machine is stopped or crashes
`inet.buckets.object.created`	An object is uploaded to any Bucket
`inet.buckets.object.deleted`	An object is deleted from a Bucket
`inet.functions.error`	A Function invocation returns an error
`inet.iam.key.issued`	A new API key is created
`inet.iam.policy.changed`	An IAM policy is modified

Delivery guarantees and dead letters

Events are delivered at least once. Subscribers should be idempotent. Events that exhaust their retry budget (default: 5 attempts with exponential backoff) are written to the subscription's dead-letter topic for inspection and replay.

# Inspect dead letters inet events dead-letters list --subscription order-placed-process-order # Replay a dead letter inet events dead-letters replay <event-id>

Logs Platform

Logs collects stdout, stderr, and structured log output from every resource in your project. No agent configuration required for Functions; install the INET log agent on Machines for system and application log forwarding.

Query logs

# Tail live output from a Function inet logs tail --fn my-handler # Search the last 6 hours for errors inet logs query \ --since 6h \ --level error \ --text "connection refused" # Filter by resource inet logs query --machine web-1 --since 1h

Log levels

Structured logs should include a level field. Supported values: debug, info, warn, error. Unstructured output is indexed as plaintext at level info.

Retention

Setting	Default	Range
Log retention	30 days	7 days – 2 years
Index resolution	Full text	—
Export	On demand	To any Bucket

# Export logs to a Bucket inet logs export \ --since 30d \ --bucket my-bucket/logs/2026-03/

Log-based alerts

Trigger a Function or publish an Event when a log pattern matches. Alerts evaluate on a rolling window.

inet logs alerts create \ --name high-error-rate \ --pattern "level=error" \ --threshold 10 \ --window 5m \ --action fn:notify-oncall

Metrics Platform

Metrics collects time-series data from all platform resources automatically. Query built-in metrics or push custom counters, gauges, and histograms from your application.

Built-in metrics

Metric	Type	Source
`machine.cpu.utilization`	gauge	Machines
`machine.memory.used_bytes`	gauge	Machines
`machine.disk.read_bytes`	counter	Machines
`machine.network.rx_bytes`	counter	Machines
`fn.invocations`	counter	Functions
`fn.errors`	counter	Functions
`fn.duration_ms`	histogram	Functions
`bucket.requests`	counter	Buckets
`bucket.storage_bytes`	gauge	Buckets

Custom metrics

# Push a counter increment inet metrics push \ --name app.orders.placed \ --type counter \ --value 1 \ --labels "region=mia1,plan=pro" # Push a gauge inet metrics push \ --name app.queue.depth \ --type gauge \ --value 142

Query

# Average CPU over the last hour inet metrics query \ --metric machine.cpu.utilization \ --machine web-1 \ --since 1h \ --agg avg

Metric-based alerts

inet metrics alerts create \ --metric machine.cpu.utilization \ --condition "gt 0.9" \ --window 5m \ --action fn:scale-out

IAM Platform

IAM controls authentication and authorization for every API call on the platform. All requests are evaluated against IAM policy in real time. Access decisions are written to Logs automatically.

Built-in roles

Role	Permissions
`owner`	Full access including billing and project deletion
`admin`	Full access to all resources; cannot delete the project
`developer`	Read/write on Machines, Functions, Buckets; read on Logs and Metrics
`viewer`	Read-only across all resources

Custom roles

Define a role with an explicit permission set. Permissions follow the pattern <service>:<resource>:<action>.

inet iam roles create deploy-only \ --allow "functions:*:deploy" \ --allow "functions:*:read" \ --allow "buckets:my-bucket:write"

Service accounts

Service accounts are non-human identities for CI/CD pipelines, Functions, and automation. They receive an API key and can be assigned any role.

inet iam service-accounts create ci-pipeline \ --role deploy-only

API keys

# Create a key scoped to a single bucket inet iam keys create \ --name s3-backup-writer \ --scope "buckets:backups:write" \ --expires 90d # Rotate a key with zero downtime inet iam keys rotate s3-backup-writer --overlap 1h

Temporary credentials

Issue short-lived tokens for delegated access without creating a permanent key.

inet iam tokens issue \ --role viewer \ --ttl 15m

Secrets Platform

Secrets stores sensitive values — API keys, database passwords, tokens — encrypted at rest. Values are never returned after write and are never logged. Access is governed by IAM policy.

Secret values cannot be retrieved via the CLI or API after creation. Store them at write time or rotate to a new version.

Store and retrieve

# Write a secret (value read from stdin) inet secrets set DATABASE_URL Enter value: ████████████ # List secrets (names only, never values) inet secrets list # Check metadata inet secrets describe DATABASE_URL

Inject into Functions

Secrets are injected as environment variables at invocation time. The value is never stored in your function config or visible in deployment metadata.

inet fn deploy my-handler \ --runtime go122 \ --secret DATABASE_URL \ --secret STRIPE_SECRET_KEY

Inject into Machines

inet machines secrets attach web-1 \ --secret DATABASE_URL \ --mount-as env

Versioning and rotation

# Write a new version inet secrets set DATABASE_URL --version new # List versions inet secrets versions DATABASE_URL # Pin a resource to a specific version inet fn deploy my-handler --secret DATABASE_URL@v3 # Enable automatic rotation inet secrets rotation enable DATABASE_URL \ --interval 30d \ --handler fn:rotate-db-password

TLS Edge

TLS certificates are provisioned and renewed automatically when you attach a domain to a platform resource. HTTPS is the default; HTTP is not served on public endpoints.

Attach a domain

# Attach to a Machine (certificate issued automatically) inet tls attach \ --domain api.example.com \ --machine web-1 # Attach to a Function HTTP trigger inet tls attach \ --domain hook.example.com \ --fn my-handler

Certificate lifecycle

Event	When
Initial issuance	Within 2 minutes of domain attach
Auto-renewal	30 days before expiry
Zero-downtime rotation	New cert served before old is revoked

Custom certificates

Upload a PEM bundle if you have CA requirements not met by ACME (e.g., EV certificates, internal CAs).

inet tls upload \ --domain api.example.com \ --cert ./fullchain.pem \ --key ./privkey.pem

Termination modes

Mode	Behaviour
`edge` (default)	TLS terminated at the INET edge; plain HTTP to your service on the private network
`passthrough`	Raw TLS forwarded to your service; you handle termination
`mtls`	Client certificate required; for service-to-service authentication

inet tls mode set api.example.com --mode passthrough

DNS Edge

DNS manages public zones and records for your domains, and provides automatic private resolution for all resources within a project. Delegate your domain to INET nameservers and changes propagate immediately.

Add a zone

inet dns zones create example.com

Update your registrar's nameservers to the values returned by this command. INET operates anycast nameservers for low-latency resolution globally.

Manage records

# A record inet dns records create example.com \ --type A --name api --value 1.2.3.4 --ttl 300 # CNAME inet dns records create example.com \ --type CNAME --name www --value example.com # MX inet dns records create example.com \ --type MX --name @ --value "10 mail.example.com" # TXT (e.g. SPF) inet dns records create example.com \ --type TXT --name @ --value "v=spf1 include:i-nter.net ~all"

Private DNS

Every resource gets a private hostname automatically at provision time. These resolve only within your project VLAN — no configuration required.

Resource	Private hostname pattern
Machine	`<name>.machines.internal`
Function	`<name>.functions.internal`
Bucket	`<name>.buckets.internal`

Health-check routing

INET monitors your endpoints and removes unhealthy records from DNS automatically. Configure a health check on any A or AAAA record:

inet dns records health-check enable \ --zone example.com \ --record api \ --path /health \ --interval 30s \ --threshold 2

Firewall Edge

Firewall enforces inbound and outbound traffic policy at the hypervisor level — before traffic reaches your Machine OS. Rules apply instantly with no downtime. Internal traffic within a project VLAN is not affected by public firewall rules.

Apply a profile

Profiles are pre-built rule sets for common workloads. Apply one as a starting point and extend with custom rules.

inet firewall profile apply web --machine web-1 # Allows: 80/tcp, 443/tcp inbound. Blocks: everything else public.

Profile	Opens
`web`	80/tcp, 443/tcp inbound
`database`	Project VLAN only; no public ingress
`gaming`	Game-specific UDP/TCP port ranges (configurable)
`none`	Default deny all; start from scratch

Custom rules

# Allow SSH from a specific IP inet firewall rules add \ --machine web-1 \ --direction inbound \ --proto tcp \ --port 22 \ --source 203.0.113.42/32 \ --priority 100 # Block outbound to a CIDR inet firewall rules add \ --machine web-1 \ --direction outbound \ --proto any \ --dest 10.0.0.0/8 \ --action deny \ --priority 50

Rule evaluation

Rules are evaluated top-down by priority (lower number = higher priority)
First matching rule wins
Default policy is deny — traffic not matched by any rule is dropped
Every dropped packet is logged in Logs with source, destination, and matched rule

Project-wide rules

Rules can be applied at the project level to cover all current and future Machines without per-resource configuration.

inet firewall rules add \ --project \ --direction inbound \ --proto tcp \ --port 443 \ --source 0.0.0.0/0 \ --priority 200

Documentation