Bring your own serversPreview

Bringing your own servers is in preview and enabled per account. The console flow, the licence format and the API endpoints described here may change before release. Ask Ankra support to enable it for your account.

You can add dedicated servers you already rent or own, at any provider or in your own rack, to your private cloud. Ankra turns each one into a hypervisor host of a zone that only your account sees. Your servers there are created and managed with the same console, API, CLI, Terraform provider and MCP tools as on Ankra's own hosts, and no other customer's server is ever placed on them.

A server joins with a host licence: a key you create in the console and hand to the server. The licence is the only credential that moves between your account and the machine. Nothing else (no API token, no account password) is ever placed on the host.

How it works#

1. Create a host licence in the console. It names the region your server stands closest to and how the server is set up: by Ankra over SSH, or by you.
2. Hand the licence over. Either give Ankra SSH access to the server together with the licence, or put the licence on the server yourself when you install the hypervisor.
3. The server enrols. It presents the licence to the control plane, which checks it, binds it to that machine and gives the host its own identity and certificate. The licence cannot be used on any other machine afterwards.
4. The host joins your private zone. It links to the control plane and to your other hosts over WireGuard, runs a burn-in, and its capacity shows up under Private cloud. You can create servers on it straight away.

Before you start#

Every server you bring must have:

The install takes over the whole machine: the host's firewall, networking, disks and kernel settings are managed by Ankra from then on. Do not bring a server that runs anything else.

Create a host licence#

In the console, open Private cloud → Your servers → Add a server and choose:

• Region: the region your server is closest to. Your hosts in one region form one private zone; the first host you add creates it.
• Setup: Ankra sets it up (you give Ankra SSH access) or I install it myself.
• Roles (optional): every host runs your servers. Hosts can also carry your zone's replicated storage once you have three or more, and its gateway. Leave the default unless Ankra support advised otherwise.

The console shows the licence once, starting with ahl_. Copy it then; afterwards only its last four characters are shown. The same works over the API:

curl -X POST https://cloud.ankra.app/v1/private-cloud/host-licences \
  -H "Authorization: Bearer $ANKRA_CLOUD_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{ "region": "eu-north", "setup": "self", "label": "rack-2 server 4" }'

Creating a licence needs the billing.manage permission, the same as requesting private capacity. One licence adds one server. A licence nobody claims expires after 24 hours; create a new one if it does.

Option 1: Ankra sets it up over SSH#

Choose this when the server is freshly installed by your provider (any recent Debian or Ubuntu image) and you want Ankra to do the rest.

1. Add Ankra's SSH key. The licence page shows your account's install key, an ssh-ed25519 public key. Add it to /root/.ssh/authorized_keys on the server, or to a user that can run sudo without a password:

   bashCopy

   echo 'ssh-ed25519 AAAA… ankra-cloud-install@<your account>' >> /root/.ssh/authorized_keys
   

   Only Ankra's installer holds the private key, and only for the servers you name.

2. Give the server's address. Enter its public address, the SSH port and the user. If your server accepts SSH only from known addresses, allow the addresses the page lists.

3. Confirm the host key. Ankra connects once and shows the fingerprint the server presented. Compare it with the server's own (ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub on the server, or your provider's console) and confirm. Nothing is installed before you do.

4. Check the probe. Ankra reads the server's CPU, memory, disks and network and shows them under Probed facts, with anything that falls short of the minimums. Pick the data disks Ankra may use. These disks are erased.

5. Install. Ankra installs the hypervisor with your licence, sets up the WireGuard links, runs the burn-in and reboots the server once to turn on the kernel settings virtualisation needs. The install log follows every step.

When the install is done, choose whether Ankra keeps SSH access. Agent upgrades never need it: they reach the host over its control-plane link. Keeping it lets Ankra change the host's roles or reinstall it for you; without it, you give SSH access again when that is needed. Remove SSH access removes the install key from the server.

Option 2: Install the hypervisor yourself#

Choose this when Ankra must never log in to the machine, or when you install over your own BMC (iDRAC, iLO, IPMI) without a provider image. The licence is the only thing the server needs.

Boot the installer image#

The Ankra Cloud installer image is a bootable ISO (UEFI and BIOS). It installs Debian 13 on the server's smallest disk of 16 GiB or more, erasing that disk, and leaves every other disk untouched for your servers. Download it from the licence page, which shows its SHA-256, and give it a seed with your licence:

#cloud-config
users:
  - name: ankra
    groups: [sudo]
    sudo: "ALL=(ALL) NOPASSWD:ALL"
    lock_passwd: true
    ssh_authorized_keys: [ssh-ed25519 AAAA… [email protected]]
ankra_cloud:
  licence: ahl_…
  region: eu-north

Hand the seed to the server in one of these ways:

Write the image to a USB stick or attach it as BMC virtual media, and boot. The installation starts after 10 seconds and needs no answers. On first boot the host enrols with the licence; journalctl -u ankra-host-enroll on the host shows it, and it retries every minute until the control plane answers.

Or install on a running system#

On a fresh Debian 13 or Ubuntu 26.04 install, download the node agent, check it against the SHA-256 the licence page shows, and install with the licence. Run the plan first; --dry-run changes nothing:

curl -fsSLo ankra-node https://cloud.ankra.app/v1/node-installer
echo '<sha256 from the licence page>  ankra-node' | sha256sum -c -
chmod +x ankra-node
sudo ./ankra-node install --licence 'ahl_…' --dry-run
sudo ./ankra-node install --licence 'ahl_…' --ssh-allowed-network <your admin networks>

• --ssh-allowed-network is the list of networks SSH is still accepted from once the host's firewall is on. Include the address you are working from, or your next SSH login fails.
• When the server has a single disk or one RAID volume, add --local-storage-file /var/lib/ankra-local.img --local-storage-size-gibibytes <size> so your servers' volumes have room.
• Reboot once when the install asks for it (the console shows Reboot pending).

What Ankra can and cannot do on your servers#

• The node agent runs as root on the host. It has to: it starts and stops your virtual machines, manages disks, firewall and networking, and installs its own upgrades. It reaches only the Ankra control plane, over the host's WireGuard link.
• Ankra staff never log in to your virtual machines. The host serves their consoles only to your account, the same as on Ankra's own hosts.
• SSH to the host is allowed only from the networks you named and, if you chose Ankra sets it up and kept access, for Ankra's install key. Every install, role change, upgrade and retirement is an operation in your audit log.
• Ankra cannot reach your provider's account, your BMC or any machine you did not add.

Networking on your hosts#

Your hosts reach the control plane and each other over WireGuard, so they need no private network or switch between them and can stand at different providers. Your servers on them are on the same private networks as anywhere else in your account.

Public addresses come from what your provider delivers to the host. A server gets a /64 from the host's public IPv6 range, which Ankra registers as your zone's pool when the host joins. Any additional IPv4 addresses your provider routes to the host can be assigned to servers as floating IPs. A host whose provider delivers no IPv6 range gives your servers IPv4 reachability through a network edge only.

The licence's life#

Revoke on the licence (or DELETE /v1/private-cloud/host-licences/{id}) retires the host it is bound to: Ankra moves your servers to your other hosts where they fit and asks you first about the ones that do not, takes the host out of your zone's storage, erases its data disks and removes its identity, the agent and Ankra's SSH keys. The system disk is not erased; wipe it yourself before the hardware goes elsewhere.

To move a licence to another machine, revoke it and create a new one. A host that broke and was reinstalled needs a new licence too: the old one stays bound to the machine it was claimed by.

Billing#

Each active licence is charged a monthly host fee, shown when you create it and on your invoices. Servers on your own hosts are not charged per hour for their vCPUs, memory or boot storage: you already pay your provider for the machine. Everything else is billed as usual, such as backups, object storage, managed databases and the IPv4 add-on for addresses Ankra provides. An issued, expired or revoked licence costs nothing.