Provisioning spokes

A spoke is one Moodle for one cohort, customer, or department. Each is its own tenant — own database, own moodledata, own users.

The wizard

/spokes → New spoke opens a four-step wizard:

Step 1: Identity

• Slug — short, lowercase, becomes part of the URL. acme-q1-2026 works; Acme Q1 2026 doesn't.
• Display name — what users see in the Moodle top bar. Anything reasonable.
• Domain — defaults to <slug>.nucleuslms.io. Bring-your-own-domain (BYOD) is supported on Dedicated tier; you point a CNAME at us and we issue a Let's Encrypt cert.

Step 2: Federation

• Mode — inherits from the federation by default. You can override per-spoke for content, but identity is federation-wide.
• Content mode — subscribe (auto-pull on publish), pull (manual pull only), or mirror (full clone, no future updates). subscribe is the right answer most of the time.
• Brand — optional override for theme colour. If unset, the spoke inherits the federation's brand.

Step 3: Sizing

Pick Small / Medium / Large. The cost preview shows recurring monthly + due-now proration before you commit. See Concepts → Sizing for the resource tables.

You can resize later — /spokes/<id> → Actions → Resize. ~30 seconds of pod restart, no data loss.

Step 4: Confirm

Review everything, hit Provision. The button labels the charge so you can't miss it.

What happens next

The spoke goes through the standard tenant lifecycle: provisioning → running. Provisioning is 3–8 minutes; you'll see updates streaming into the spoke detail page and into your notifications.

When it lands, the spoke admin invitation email goes to whichever address you specified in step 1 (defaults to your own). They'll set a password and log in via the link.

DNS

For a default subdomain like acme.nucleuslms.io:

• DNS is automatic. We control the zone.
• TLS is automatic via Let's Encrypt.
• Provisioning waits for the cert before flipping to running.

For BYOD on Dedicated:

• You add a CNAME pointing at the cluster ingress. We give you the value during the wizard.
• Cert issuance starts as soon as the CNAME resolves.
• If your DNS isn't ready when the chart rolls out, the spoke goes into degraded until it is.

Bulk operations

Hub admins can act on multiple spokes at once via POST /api/spokes/actions (suspend, resume, delete). The portal exposes the same as multi-select on the /spokes table.