teploy cloud: log in to Teploy Cloud, list and create managed servers

CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to teploy are documented here. Format follows [Keep a Change
 
 ## [Unreleased]
 
+### Added
+
+- `teploy cloud`: connects the CLI to Teploy Cloud (https://cloud.teploy.com).
+  `login` (API key read hidden or with `--key-stdin`, `--org`; checked, then stored in
+  `~/.teploy/cloud.yml` with mode 0600), `logout`, `status`, `servers`, `regions`,
+  `sizes`, `server create` and `server delete`. `server create` registers the local SSH
+  public key if Cloud does not have it, shows the monthly price and asks before buying
+  (`--yes` skips), sends one `Idempotency-Key` across retries, waits for the server to
+  become active, adds it to servers.yml as `root@<ip>` (refusing an existing name) and
+  runs `teploy setup` unless `--no-setup`. `server delete` asks first and removes the
+  servers.yml entry only when its host is the deleted server's address.
+  `TEPLOY_CLOUD_URL` selects another instance; plain http is refused except to
+  localhost.
+
 ## [0.1.55] - 2026-11-06
 
 ### Added

README.md

@@ -573,6 +573,18 @@ teploy network setup <provider>    # VPN mesh (tailscale, headscale, netbird)
 teploy network status / join       # VPN management
 ```
 
+### Teploy Cloud servers
+
+`teploy cloud` buys and deletes managed servers on [Teploy Cloud](https://cloud.teploy.com) with an organization API key. A created server is added to `~/.teploy/servers.yml` and set up with `teploy setup`, so it is ready for `teploy deploy`. See [docs/cloud.md](docs/cloud.md).
+
+```
+teploy cloud login                       # API key (hidden) + organization id, stored in ~/.teploy/cloud.yml
+teploy cloud sizes --provider vultr      # what can be bought, with monthly prices
+teploy cloud server create web1 --provider vultr --region ewr --size vc2-1c-1gb
+teploy cloud servers                     # the organization's servers
+teploy cloud server delete web1
+```
+
 ### Domains
 
 ```bash
@@ -1240,6 +1252,7 @@ One app runs one image; multi-image stacks are refused, not approximated — see
 - [CI/CD](docs/ci-deploy.md) — push-to-deploy with Forgejo/GitHub Actions
 - [Secrets scanning](docs/secrets-scanning.md) — Gitleaks recipe
 - [Resilience](docs/resilience.md) — surviving server loss (topology + runbook)
+- [Teploy Cloud](docs/cloud.md) — buying managed servers from the CLI
 
 ## Comparison
 

docs/cloud.md

@@ -0,0 +1,21 @@
+# Teploy Cloud
+
+`teploy cloud` talks to Teploy Cloud (https://cloud.teploy.com), which sells managed servers. It needs an API key and the id of the organization the key belongs to, both from the Teploy Cloud dashboard; `teploy cloud login` checks them and stores them in `~/.teploy/cloud.yml` (mode 0600). `teploy cloud server create` buys a server, adds it to `~/.teploy/servers.yml` and runs `teploy setup` on it, so the next step is `server: <name>` in `teploy.yml` and `teploy deploy`.
+
+```
+teploy cloud login --org <org-id>                 # prompts for the key without echoing it
+printf '%s' "$KEY" | teploy cloud login --key-stdin --org <org-id>
+teploy cloud status                               # URL, organization, whether the key works
+teploy cloud regions --provider vultr
+teploy cloud sizes --provider vultr --region ewr
+teploy cloud server create web1 --provider vultr --region ewr --size vc2-1c-1gb [--ssh-key ~/.ssh/id_ed25519.pub] [--no-setup] [--yes]
+teploy cloud servers [--json]
+teploy cloud server delete web1 [--yes]
+teploy cloud logout
+```
+
+`server create` bills the organization monthly and asks before buying unless `--yes` is given. The SSH public key is `--ssh-key`, else `~/.ssh/id_ed25519.pub`, else `~/.ssh/id_rsa.pub`; it is registered with Teploy Cloud only if no key with the same public key is there. If setup fails after the server is active, the server stays bought and in servers.yml; re-run `teploy setup <ip> --name <name>`.
+
+`server delete` destroys the server and everything on it. The servers.yml entry of the same name is removed only when its host is the deleted server's address.
+
+`TEPLOY_CLOUD_URL` points the commands at another Teploy Cloud instance. Plain http is refused except to localhost and 127.0.0.1.