1. What monetize is
Written from the code on monetize main c9b473a5 (2026-11-04). Where a sentence rests on a line of code, the file:line follows it.
1.1 In one paragraph
monetize is the money engine behind the Vetra products (Gunnar, Holger): it sells, lays, pairs, upgrades and terminates a customer's own machines at a cloud provider, sells hosted accounts and room on a product site, takes the money through a payment vendor, and keeps the one append-only ledger every number is folded from. It runs as one machine, the ONE box, for every product. The products reach it through signed plugins; the products' machines reach it by calling in; monetize dials no estate.
1.2 The words
| word | meaning | where |
| the ONE box | the one machine that runs monetize for every product: monetize-admin is its PID 1 on a tunnr kernel (korp-start), and the same binary is its two other processes: monetize-server on 127.0.0.1:50061 and the console on 127.0.0.1:8091. The edge carries :80/:443 and the operator's door :8475 |
crates/monetize-admin/src/lib.rs; README.md |
| product | something the box sells estates and accounts of: Gunnar (a git server), Holger (an artifact server). A product is known to the box only through its signed guest <product>_monetize_guest.wasm; the box links no product |
crates/monetize-product-guest/src/lib.rs:1-20 |
| estate | one customer's set of machines of one product at the cloud: a front, a main and a twin (the roles the product's facts declare), laid from the product's release media, paired to the ONE box |
crates/monetize-cloud/src/lay.rs:30 |
| site | an estate the operator ordered for a product's public face: www.gunnar.rs, www.holger.rs. A site relays every buy to the ONE box (chapter 4) and is upgraded by it. Declared in the kit's solo.toml as [boxes.<box>.estates.<label>] with operator_site = true |
private-monetize-ops/solo.toml:65-161 |
| sold estate | an estate a customer bought on a site ("a private Gunnar"): paid once at the vendor, laid by the ONE box, owned by the buyer's account, paid six months ahead | crates/monetize-server/src/estate_order.rs |
| account | a hosted tenant on a product site: free (a 0 kr card check) or a paid plan with a byte cap and a period | crates/monetize-server/src/signup.rs |
| the shop | the ONE box's selling side as a site sees it: EstateOrder, Signup, Purchase, Products over gRPC at the edge |
crates/monetize-proto/proto/monetize/v1/*.proto |
| the feed | one flat JSON object the operator's kit builds from solo.toml and PUTs on the box's door: the plugins (base64), their blocks and prices, the secrets by name, the media ids, the operator's monetize.toml fragment |
private-monetize-ops/xtask/src/admin.rs:337-391; crates/monetize-front/src/intake.rs |
| plugin / guest | a signed .wasm the box loads in a sandbox: a product guest, a payment vendor (stripe.wasm), a cloud (upcloud.wasm), a DNS writer (dns_cloudflare.wasm), a signup sink |
chapter 3 |
| Guardian | the ONE box's repair runner for estates: it reads what the boxes report, opens a case when something is wrong, and carries out the product's plan (fence, lay, order, await); it never calls into an estate | crates/monetize-guardian |
| the ledger | the append-only rows under <data>/monetize/ledger.redb, written before every external call; every derived number is a fold of it |
crates/monetize/src/ledger.rs |
| entitlement fact | what monetize believes about a tenant, signed with Ed25519 so the product verifies it offline: tenant, plan, state, paid_until, caps |
crates/monetize-product/src/lib.rs:631-692 |
| test buy | the operator's own buy of a site or an estate at a held price of EUR 0.50, booked as a test and never as revenue; and the console's test button, which buys a hosted plan or a private instance with the vendor's test card | crates/monetize-server/src/estate_order.rs:1113-1144; src/test_purchase.rs |
1.3 The shape, in one picture
buyers ──▶ product SITE (www.gunnar.rs / www.holger.rs: a sold estate itself)
│ relays every buy (gRPC, the site's ONE bearer)
▼
THE ONE BOX ── signed plugins: <product>_monetize_guest.wasm, stripe.wasm,
│ upcloud.wasm, dns_cloudflare.wasm; the ledger; the console
│ lays, pairs, upgrades (through the cloud's API and the installer link)
▼
sold ESTATES (front · main · twin) ── every box DIALS the ONE box
(Fleet.Report / Orders / Ask); it is never dialledThe ONE box's only outbound calls go to the cloud providers, the payment vendors, the DNS zones and its own release bucket (README.md; crates/monetize-proto/proto/monetize/v1/fleet.proto:5).
1.4 What the box sells, and to whom
| what | who buys | how it is paid | what happens |
| an account (free) | a visitor on a site | a 0 kr card check | the product's signup guest, or an add_principal order to the site's main, creates the account; the welcome mail carries the passkey invite |
| an account plan | a visitor or a signed-in account | once per period at the vendor | a signed entitlement fact with the caps and paid_until |
| more room, more users | a signed-in account | at the vendor | reserve → ensure (the cloud) → capture → the fact is pushed; a sale past the main's room is still made and the estate is told to grow |
| a private estate | a visitor (a new account is made) or an account | ONCE at the vendor, six months ahead | lay, install, pair, the term; the buyer's own site at <company>.<apex> |
| a bigger estate step | the estate's account | the difference at the vendor | a paid data step; the estate grows its own disks |
| a renewal | the estate's account | six more months at today's price | the term is extended from the end of the paid period |
| a site (operator) | the operator, from the console or the CLI | EUR 0.50, booked as a test | the box lays its own product site, which then sells |
1.5 Who runs it
One operator per ONE box: the person with the box's installer material (the kit's mutual-TLS client certificate for the door :8475), the console passkey(s) and the break-glass token. The operator feeds the box, orders sites, watches the console, reads the alert mails and runs the updates (chapter 7). There is no second role: the Guardian and the estates act on signed orders, buyers act on their own sites.
1.6 Where things are
| the code | ssh://git@git.gunnar.rs:2222/nordisk/monetize (open, AGPL-3.0-only; the paid vendor and cloud guests are built from the private monetize-impl) |
| the kit | ssh://git@git.gunnar.rs:2222/vetra/private-monetize-ops (cargo xtask … on the operator's machine) |
| the box's data | /data on the box: monetize/ (the config, guests, vendors, clouds, dns, signup, trust, secrets, the stores), solo/ (the feed), monetize-ui/ (passkeys and sessions), money/lines.log, offsite/ |
| the live service | https://monetize.vetra.se runs the same code |