Node topology classes
A node declares what it is when you add it — VPS, single-IP dedicated, or multi-IP dedicated. The class decides how instances are reached and what instance creation can offer.
When you add a node you pick its topology class — a one-time choice of what the box is. Enrollment sets the box up for that class (OS, hardening, and networking), and from then on instance creation only offers what the class can actually deliver. One node, one class; you choose it in the add-node wizard alongside the OS image.
The three classes
| Class | What it is | How instances are reached |
|---|---|---|
vps | A cloud VPS — one provider IP, no extra addresses. | Instances sit behind NAT, fronted by the one public IP. |
dedicated-single-ip | A dedicated / bare-metal box with one usable IP. | Same NAT-behind-one-IP model as vps, but the box is sized for real density. |
dedicated-multi-ip | A proper dedicated server with a routed IP block / multiple usable IPs. | Instances can get a real public IP from a node-scoped pool, on top of the NAT option. |
vps is the default. The class is the single source of truth for the node, so adding the node, enrolling
it, and creating instances can never disagree about what's allowed on that box.
What each class can deliver
| Capability | vps | dedicated-single-ip | dedicated-multi-ip |
|---|---|---|---|
| Instance types | VM (default) + container | VM (default) + container | VM (default) + container |
| Address modes | NAT only | NAT only | NAT or routed |
| Routed public-IP pool | — | — | ✓ |
- Instance types — every class runs KVM VMs by default and allows LXC containers as a trusted-only opt-in. See Tenant isolation for why the default is a VM.
- Address modes — the single-IP classes can only place an instance behind NAT. Only
dedicated-multi-ipcan also give an instance a real routed public IP. - IP pool — only
dedicated-multi-ipcarries a routed block; the others have nothing to route.
The class enforces its own rules
A vps or dedicated-single-ip node can't carry an IP block — it's single-IP, NAT only. A
dedicated-multi-ip node must declare an IP block (addresses + CIDR + gateway) when you add it,
because its routed option has nothing to assign without one. The wizard checks this before the node is
created.
What enrollment sets up
Enrollment doesn't just install the agent — it sets the node up for its class. The panel decides the setup and the agent applies it (the panel never SSHes in to configure):
- OS — the image you chose (Ubuntu 24.04 by default).
- Hardening — firewall + fail2ban + sysctl + automatic security updates.
- Networking — a managed NAT bridge on every class; plus, for
dedicated-multi-ip, the routed setup that makes the declared IP block assignable per instance.
How instance creation respects the class
When you create an instance, the dialog reads the node's class and offers only what that class can do:
- the default instance type is VM for every class;
- container is offered as a labelled trusted/internal-only opt-in;
- the address mode chooser shows NAT only on the single-IP classes, and NAT or routed on
dedicated-multi-ip; - the routed public-IP option (and the pool to draw from) appears only on
dedicated-multi-ip.
So you can never accidentally ask a single-IP VPS for a routed public IP it can't deliver.
Next steps
- Tenant isolation — why instances default to a KVM VM, and the hostile-tenant network boundary every class enforces.
- Instances — creating and managing instances on a node.
- Bring a server online — the add-node wizard and the enroll/reconcile model.
Nodes
Bring a server under SpipCP's control — enroll it once over SSH, harden it, and keep it converged — then manage it from the node workspace.
Tenant isolation
Why instances default to a KVM VM, why a shared kernel is not a tenant boundary, and the three network controls every node class enforces so tenants can't see, reach, or spoof each other.