Provider credentials & regions

Configure the VPS, DNS, CDN, and email credentials that back the premium tiers. Skip any you don’t sell yet — a Shared-only launch on a server you register yourself needs none of them.

Shared provider slugs, labels, setting keys, and capabilities come from ImpulseCore’s provider catalog; only product-specific plan, pricing, and DNS maps stay local to ImpulseSecrets. Everything on this page lives under the addon’s Settings tab.

1. VPS providers (Dedicated / BYOK)

Dedicated and BYOK services provision a single-tenant VPS on demand. Under Settings → Providers & Regions, add credentials for one or more of the eight supported providers. Customer orders on the Shared tier never provision a VPS, so you can skip this section for a Shared-only launch — unless you want the addon to provision the shared server itself.

Supported VPS providers: vultr, hetzner, digitalocean, linode, proxmox, aws, azure, gcp.

Add each provider’s API token (with server create/destroy permission) in the provider’s settings block. The provisioning wizard under Infrastructure → + Provision New Server then targets a configured provider; each box comes up with the engine’s stack and a scoped Admin Proxy already installed. To use a host you already run instead, Infrastructure → + Add Existing Server registers it and builds a one-time installer.

Admin Proxy, not SSH

Provisioned boxes are managed through a typed, scoped Admin Proxy — not injected SSH keys. Break-glass SSH is off by default (Settings → General & Access). You do not need to register an SSH key pair to run Dedicated/BYOK.

2. DNS & TLS

Under Settings → DNS & TLS, configure Cloudflare DNS, which provisioned servers use for their hostnames and certificates:

• Secrets Domain — required. Each dedicated server gets the hostname sec-<service-id>.<secrets-domain>.
• Cloudflare Zone ID and Cloudflare API Token — the token needs Zone:DNS:Edit and Zone:Zone:Read on the zone. Test DNS Connection creates and deletes a test TXT record.
• Registration Email — used when requesting Let’s Encrypt certificates; it receives renewal expiry notices.

With the token set, the module creates a provisioned server’s DNS records, and the server obtains a Let’s Encrypt certificate through a Cloudflare DNS challenge. Without one, or while issuance hasn’t succeeded, the Admin Proxy serves a self-signed certificate that WHMCS pins on first contact (TOFU SPKI pinning), and a later change of that certificate is reported as a pin mismatch.

Check the certificates servers present

Diagnostics → Health Checks has a TLS certificates panel that handshakes with each active server on port 443 and shows the live certificate’s issuer, expiry, and SANs, flagging self-signed, expiring, and expired certificates. A wildcard on the apex does not cover a deeper per-server hostname, so check the SANs against the server’s hostname rather than trusting the configuration.

3. CDN & custom domains

Customer custom domains are a premium feature served through Cloudflare for SaaS. Under Settings → CDN & Custom Domains, add your Cloudflare zone and API token if you will offer customers a hostname they own.

When a customer adds a domain from their client area, the module creates the Cloudflare for SaaS custom hostname and shows the CNAME to create. The domain_polling cron re-checks DNS and SSL status every 5 minutes until both are active. Leave this blank if you are not selling custom domains.

4. Email delivery

Under Settings → Email Delivery, choose a provider (SMTP2GO, Postmark, Mailgun, SendGrid, Resend, Amazon SES, or custom SMTP) and a sender domain. This config is rendered by ImpulseCore’s shared email-delivery service and baked into provisioned instances so member invites and notifications send from your domain.

One tab, shared service

The Email Delivery tab is the same shared ImpulseCore surface every module renders. Configure it once per module; provisioned Secrets instances pick up the SMTP config at bootstrap.

5. Regions & engine matching

Each server — shared or dedicated — belongs to a region and runs one engine (OpenBao or Infisical). Plans can pin a region and target an engine, and provisioning refuses to place a service on a server whose engine does not match the plan’s engine.

• Register shared capacity for each engine you intend to sell in a region, or Shared Create will fail cleanly with a “no capacity” message.
• For Dedicated/BYOK, the VPS goes to the region the order names — mapped to the provider’s region code through ImpulseCore → Projects → Regions — or else the provider’s default region.
• Confirm each server shows healthy on the Dashboard region summary and under Diagnostics → Health Checks before selling into that region.

Test before relying

After configuring any provider, confirm the connection with the VPS Providers check under Diagnostics → Health Checks and watch the Dashboard region summary. Failures caught here are cheaper than failures a customer order surfaces for you.