Turn bare metal into a
cloud you can sell
Nexaplane is a cloud orchestrator built natively for Proxmox. Give every customer their own isolated network, their own routers, and a portal they can serve themselves from — while you bill for it automatically.
What actually separates us
Every tenant gets
their own real routers.
Not a shared gateway with firewall rules bolted on. Each tenant runs their own routing appliances — as many as their network needs — with the protocols a network engineer expects, and none of the operational weight of Neutron or NSX.
One tenant. Everything above is provisioned automatically when they click create.
Routing that speaks the language
Your customers' networks stop being an island the moment they need to reach anything else. Nexaplane gives them the protocols to do it themselves.
- BGP and OSPF — peer a tenant network with real upstream routing
- Dual-stack IPv4/IPv6 — not an afterthought; v6 firewalling and peering included
- Automatic VLAN and subnet allocation — no spreadsheet, no collisions
Isolation you don't have to configure
Each tenant lands on their own VLAN behind their own router. Noisy neighbours can't reach each other because they were never on the same wire to begin with.
- Stateful firewall — per tenant, enforced at their edge
- Security groups — reusable rule sets applied to instances
- Port forwarding — expose exactly what they mean to expose
Dual-stack, properly
IPv6 alongside IPv4 across routing, firewalling, peering and address pools — designed in from the start, not retrofitted as a checkbox.
Load balancing included
L4 and L7 balancers with TLS termination, health checks and sticky sessions — as a dedicated appliance, so heavy web traffic never starves routing.
Address management that holds
Public IPv4 and IPv6 pools, per-tenant allocation, DHCP reservations and port forwarding — tracked in one place instead of three.
Simple and secure
VPN that takes
one click, not one ticket.
Remote staff, a branch office, a second datacenter — three requests every hosting customer eventually makes, and three that normally mean keys emailed around, routing tables edited by hand, and an engineer on the call. Nexaplane terminates all of them on the router the tenant already has.
No concentrator to buy, no tunnel to hand-configure, no routing table to maintain.
Client VPN people can actually enrol in
Give a person access and they get a working profile — not a config file and a phone call. WireGuard for speed, IKEv2 for the devices that insist on it.
- One-time enrolment links — no keys pasted into email
- Per-user access control — reach only what that person should
- Full or split tunnel, per user
- Rotate or revoke instantly when someone leaves
Interconnect in a single click
Two of a tenant's routers, in different datacenters. Toggle the pair on and they are connected — the platform generates the keys, builds the tunnel and programs both sides.
- Routes follow the network — add a subnet and the far side learns it
- Conflicts flagged first — overlapping ranges surface before they break routing
- Encrypted by default — WireGuard, with key handling out of your hands
- Reversible — toggle it off and both sides clean up
Goes further with NuajProtect
Make that secure edge a filtered one
The router terminating those tunnels is the same router NuajProtect filters at line rate. Sold separately, on its own subscription — and resold at your margin.
Everything you need to
run a public or private cloud.
Nexaplane bridges the gap between hypervisor hardware and a working IaaS business — sold to customers or run for your own departments. Stop writing custom scripts and start delivering compute.
Proxmox native
- Deep integration with the PVE API
- Automated VM & LXC provisioning
- ZFS, Ceph and LVM storage pools
- Live migration and high availability
Their own network stack
- BGP, OSPF and dual-stack IPv6
- WireGuard & IKEv2 VPN, site and client
- Cross-datacenter interconnects
- Firewall, security groups, load balancers
Integrated billing
- Stripe & PayPal native processing
- Prepaid credits & post-paid invoicing
- Every resource metered by the hour
- Automated suspension on zero balance
Platform capabilities
Built for the
modern hosting provider.
Multi-tenancy that goes all the way down
Platform, provider and account scopes, each with admin, operator and user tiers. Resell through partners without them seeing each other, and give customers a branded portal where they manage their own people and API keys.
- Per-account datacenter access — decide where each customer may build
- Quotas per resource — instances, storage, addresses, GPUs
Backups your customers run themselves
Scheduled backups to Proxmox Backup Server, with one-click restore that never needs an administrator. Grant offsite disaster recovery per account and keep a copy in a second datacenter automatically.
- Policy-driven schedules — set once, applied fleet-wide
- Cross-datacenter DR — an entitlement you can sell
GPUs as a product
Nexaplane finds the cards in your fleet, groups them by model and turns each into a sellable flavour with its own capacity and quota weight. Migration-safe by design.
Storage tiers you define
Map your pools to tiers your customers understand. They pick NVMe or capacity; you keep the storage identifiers to yourself. Volumes attach and detach live.
Instances in one step
Cloud images boot in seconds with SSH keys and network configuration already injected. Console, media, snapshots, resize and migrate — all from the same screen.
One console for the whole fleet
Cluster health, capacity and every customer action in one place — plus a read-only mode that lets Nexaplane keep monitoring a datacenter while it makes no changes to it, for the nights you are working on the fabric yourself.
Toggle the pair on. Routes on both sides update themselves — and keep updating when the subnets change.
Multi-datacenter
One tenant.
Many sites.
Customers who grow past one location are the ones worth keeping. Nexaplane makes the second site a toggle rather than a project — no manual routing tables, no tunnel to hand-configure, no ticket.
- Encrypted by default — WireGuard between sites, keys handled for you.
- Conflicts caught early — overlapping subnets are flagged before they break routing.
- Routes follow the network — add a subnet and the far side learns about it.
Each customer is a tenant under you — their own users, quotas and invoice, and never a glimpse of the fabric or of one another.
The provider account
Every platform is multi-tenant.
Few hand you the business.
Carving customers into separate tenancies is table stakes. The provider account goes further — a whole cloud you run under your own name and sell to customers, or run privately for your own departments. You set each account's quotas, meter its usage and issue its invoice; the fabric and every other tenant stay out of view.
- Your brand, your portal — customers sign in to a self-service console that carries your name, not ours.
- Your invoice, your margin — meter and bill each customer directly, and resell add-ons like NuajProtect at the price you set.
- Quotas per customer — hard caps on instances, storage, addresses and GPUs, plus which datacenters each may build in.
- Isolated all the way down — one provider never sees another, and no customer ever sees the fabric beneath them.
- Roles on both sides — admin, operator and user tiers in every account, so your team and theirs get exactly the reach they need.
The no-brainer
Everything your current cloud does.
None of the weight.
You already know what a platform like this costs to keep alive — the specialists, the upgrades that go sideways, the pieces nobody wants to touch. Nexaplane does the same job with far less to run, support and explain. Every line below is something you are paying dearly for somewhere else.
Runs on standard Proxmox
A stock Proxmox VE deployment — nothing forked, patched or special to maintain, and no second stack to license.
Nothing on your hypervisors
It drives Proxmox over the API — upgrade the fabric and the cloud never notices.
Self-service routers, per tenant
Each customer runs their own virtual router — BGP, firewall, and one-click VPN between their datacenters. No Neutron, no NSX.
Load balancers customers manage
L4/L7 with TLS and health checks, run as the tenant's own appliance — not a black box only you can touch.
Customers serve themselves
A branded portal that quietly closes the tickets your team used to open.
Billing is already inside
Metering, invoices, credits and auto-suspend — not a system you bolt on later.
One service to run
A single binary under systemd — the whole control plane deploys and upgrades in minutes.
Hardware becomes products
GPUs, storage tiers and backups become flavours with quotas — priced and sold like any SKU.
Revenue you simply resell
Add-ons like NuajProtect and offsite DR, at your own margin, on infrastructure you already run.
Every site on one screen
Multi-datacenter from the first login — growth is a toggle, not a migration project.
Watch without touching
Read-only mode keeps a datacenter monitored while it changes nothing — for the nights you are on the fabric yourself.
Priced per fleet
Not per customer, not per core — your margin grows as you fill the racks.
Better together
Sell cloud that
defends itself.
Every Nexaplane tenant already has their own router sitting inline on their traffic. That is exactly where threat filtering belongs — so NuajProtect turns it into a filtered edge, and protected cloud becomes something you can sell rather than something your customer has to source, integrate and manage elsewhere.
NuajProtect is a separate product with its own subscription, licensed per protected edge. It is not bundled with a Nexaplane licence — it is an add-on you resell at your own margin, on infrastructure you already run.
NuajProtect
Filtering where the traffic already is
- At the tenant edge — the router Nexaplane already gives every customer becomes their filtering point. Nothing new in the path, nothing for them to install.
- On the instances — a single static binary under systemd protects an exposed server directly, picking the fastest enforcement the kernel offers.
- At the fabric edge — NuajBridge sits inline with no address on the network it protects, so there is nothing to scan or log into. If anything goes wrong, traffic keeps flowing.
- One threat picture — global intelligence updates both platforms, and what one network learns, the rest benefit from.
- The same operating conventions — MFA, role-based permissions and real-time alerts, so your team learns one way of working rather than two.
NuajProtect
Plug it in. Attacks stop here.
Inline threat protection for Linux servers, MikroTik routers and whole networks — filtered at line rate in the kernel's earliest packet path, with nothing exposed to attack. A separate product on its own subscription.
The commercial case
A product you can sell
to customers you already have.
Security is the easiest upsell in hosting — and the hardest one to deliver, because it usually means new hardware in the path and a project to go with it. Here it attaches to infrastructure your tenant is already renting from you.
Margin, not a referral
You licence it and you sell it. The relationship, the invoice and the margin stay yours — this is a product in your catalogue, not a handoff to another vendor.
Nothing to roll out
It attaches to the router each tenant already has. No appliance to ship, no maintenance window, no change to their network — which is what usually kills a security upsell.
Sell it as a tier
Standard and protected, priced differently — one decision at checkout instead of a separate security conversation months later.
Edge security
NuajProtect
Plug-in network threat protection for Linux servers, MikroTik routers and whole networks — filtered inline, at line rate, in the kernel's earliest packet path. Sold separately, on its own subscription.
Explore NuajProtectCloud orchestration
Nexaplane
Proxmox turned into a multi-tenant cloud with per-tenant routing, billing and self-service. Two platforms, one operating base, one engineering team.
Request a demoFrictionless architecture.
Run Nexaplane outside your fleet or inside your management cluster. It talks to Proxmox over the API — nothing to install on your hypervisors, nothing to break when you upgrade them.
Developer first
Everything the UI does,
the API does.
The complexity of CloudStack and OpenStack is what made us build this. Both can run a cloud; both ask you to staff a team to keep them running. We wanted the capability without the operations bill.
So there is no second-class API. Provisioning fleets, changing network rules, wiring billing into your CRM — the same documented REST endpoints the console itself calls.
curl -X POST https://api.nexaplane.io/v1/instances \
-H "Authorization: Bearer np_live_9a8b..." \
-H "Content-Type: application/json" \
-d '{
"name": "web-node-01",
"plan": "np-compute-4",
"image": "ubuntu-24.04-lts",
"region": "ca-central-1",
"network": "tenant-prod",
"billing": {
"type": "hourly"
}
}'Cost of operation
The download was free.
Running it never was.
CloudStack, OpenNebula and OpenStack cost nothing to install and a fortune to operate — the bill arrives as specialists on staff, upgrades that eat weekends, and architecture you fight instead of use. Nexaplane delivers the same capabilities on standard Proxmox, run by a fraction of the people it takes to keep them alive.
The architecture fights you
- A management server, database and system VMs that only you can un-break
- Advanced-zone networking that punishes every change
- Years of workarounds you finally get to retire
Lighter, still a second system
- Sunstone plus a drawer of drivers to keep current
- Networking and billing bolted on, not built in
- Runs on standard Proxmox — no host layer to curate
A team just to stay online
- A dozen services — Nova, Neutron, Cinder, Keystone, Glance — each its own upgrade
- Dependency and downtime pain on every release
- Headcount whose whole job is keeping it up
More than twenty years running data centers taught me what CloudStack and OpenStack really cost: nonsensical complexity, and quality you can never count on. Eventually I'd had enough. So I built the opposite — simplicity, elegance and function, aimed at the only job that matters: running a cloud business.
Antoine Boucher · Founder of Nuaj, owner of Halton Data Center
The move, not the migration
You don't rip anything out first
Point Nexaplane at the Proxmox you already run — it runs as a single lightweight container, with no agents baked into your hypervisors. Import running guests, stand tenants up beside the old platform, and cut each over when it is ready. The heavy stack — and the operations bill it carries — switches off last.
Why Nexaplane
The simplicity matrix
The same job, measured against the platforms you are probably weighing us against.
| Capability | Nexaplane | VMware vCD | CloudStack | OpenStack | OpenNebula | Proxmox VE (raw) |
|---|---|---|---|---|---|---|
| Time to a working platform | Minutes | Weeks | Weeks | Months | Days | Hours |
| Per-tenant router (BGP, VPN, firewall) | Automatic | NSX (costly) | Manual zones | Neutron (complex) | Manual drivers | Manual setup |
| Self-service load balancer (L4/L7, TLS) | Native | NSX ALB (costly) | Basic | Octavia (complex) | Manual | None |
| Cross-datacenter interconnect | One click | Manual | Manual | Custom dev | Manual | None |
| Sellable storage tiers | Native | Manual | Manual | Manual | Manual | None |
| Self-service backup & DR | Built-in | Third-party | Limited | Third-party | Add-on | Admin only |
| GPU as a sellable product | Native catalog | Manual | Manual | Manual | Manual | Manual |
| Built-in billing (Stripe/PayPal) | Native | Third-party ($$) | Third-party plugins | Custom dev required | Showback only | None |
| Customer self-service portal | Modern UI | Clunky UI | Dated UI | Horizon UI | Sunstone UI | Admin only |
| Integrated edge threat protection | First-party add-on | Third-party | Third-party | Third-party | Third-party | None |
| Agents on your hypervisors | None | Required | Required | Required | Required | N/A |
| Infrastructure overhead | Ultra-light | Heavy | Medium | Massive | Medium | Light |
Transparent pricing
Priced per fleet,
not per customer.
Licence the platform once. Add as many tenants as you can sell — we never take a cut of your revenue.
- Up to 10 hypervisors
- Unlimited tenants
- Community support
- Stripe billing
- Up to 20 hypervisors
- Custom branding (white-label)
- Advanced networking features
- Priority support
- Up to 100 hypervisors
- High-availability setup
- Custom API integrations
- 24/7 SLA support
- Unlimited hypervisors
- Source code licence option
- Dedicated account manager
- On-prem deployment assistance
A 14% annual fee applies to all tiers for software maintenance and priority support. NuajProtect is licensed separately and is not included in a Nexaplane licence.
See it on your own fabric.
Bring a Proxmox cluster and we will show you a tenant, a network, a router and a running instance — in the same call.
Launching 2027 · Early partners get direct input on the roadmap