PD DigitalOcean Kafka for Blesta

PD DigitalOcean Kafka lets a hosting company sell DigitalOcean managed Kafka as its own event-streaming package. Your customer orders on your Blesta order form, a dedicated three-broker Kafka cluster is built on your DigitalOcean account, and your customer manages it from the service page in your client area with your branding and no DigitalOcean login. You set the price and keep the margin over what DigitalOcean bills you.

Kafka is the log that data pipelines, event-driven back ends and real-time analytics are built on, and almost nobody wants to run it themselves. It is for hosts with developer and SaaS customers who need a message backbone and would rather rent a managed one than operate brokers.

Why hosts choose PD DigitalOcean Kafka

Three brokers, every time. Every Kafka cluster runs three brokers, so there is no high-availability setting to explain, price or get wrong. Your Kafka product has three checkout options (Region, Plan and Engine version) instead of the four other engines carry.

The details a Kafka client needs. Kafka customers are told they connect over SASL_SSL, shown a ready-to-copy kcat command, and can download the CA certificate their client has to trust. Those details are on the customer's own page, not in a ticket.

An honest minimum. DigitalOcean's smallest Kafka plan is 2 vCPU and 4 GB. Only plans DigitalOcean will take are offered, and an order for a smaller one is refused with the smallest that works, before anything is created.

A dedicated cluster per customer. Each order builds its own cluster in the region and version the customer chose. Nothing is shared with another tenant.

Access control without tickets. Customers add and remove the addresses allowed to connect themselves, and changes apply within a minute.

Nothing left billing. Cancelling deletes the cluster at DigitalOcean and confirms it is gone.

How it works

1. Connect your DigitalOcean account. Add your DigitalOcean API token once under Settings → Company → Modules, using a token with Full Access, then press Test Connection.
2. Create your package. Create a package with the module and pick Kafka as the Engine, then set a default region, plan and name prefix. Blesta's cron activates the service after payment.
3. Generate the checkout options. Open the module's Products page and press Generate options. It builds the package's Region, Plan, High availability and Engine version options from DigitalOcean's live catalogue, all priced at zero for you to set. Kafka has no high-availability option, so the group has three choices rather than four.
4. Your customer orders. They choose their options and pay. The cluster is built on your DigitalOcean account in the background, and the connection details appear on their own once it is online, usually within a few minutes.
5. You get paid, they manage it. Blesta keeps billing as usual, and the customer copies the connect command and sets their own trusted sources.

What you get in Blesta

Selling and pricing

• Checkout options for Kafka generated from DigitalOcean's live catalogue: Region, Plan and Engine version
• Versions read live from DigitalOcean; a blank version means DigitalOcean's default
• Generated choices start at zero in every currency and you price each one under Packages → Configurable Options; a sync never changes a price you have set
• Choose which choices customers see at checkout; anything hidden uses your package's default and keeps its price
• Clusters are named with your own prefix and the service number

Provisioning you can trust

• A paid order creates a dedicated Kafka cluster on your own DigitalOcean account, with no step by you
• Every Kafka cluster runs three brokers; the High availability setting has no effect on it
• An order DigitalOcean would refuse is stopped with a clear message before anything is created; Atlanta, Richmond and Kansas City carry only Premium plans
• Every cluster is recorded before DigitalOcean is asked to create it, and pressing Create again never builds a second one
• A provisioning failure appears in the service's activity with its reason, never left at "Provisioning"
• A plan change through Blesta's own plan-change flow resizes the running cluster in place; host, port and data are kept
• Suspend replaces the trusted sources with a rule nothing matches: the cluster keeps running (DigitalOcean still bills it), the data is untouched, and the customer cannot lift the lockdown. Unsuspend restores exactly the sources saved
• Terminating deletes the cluster at DigitalOcean with its users, databases and backups, and confirms it is gone. There is no retention period, so tell customers to take their own backup first

Kafka, specifically

• The connection window explains that Kafka clients connect over SASL_SSL and must trust the cluster's CA certificate
• The ready-to-use command is a kcat command with the security protocol, username and CA file filled in, and the password left for the customer to supply
• A Download CA certificate button sits beside the command
• Every cluster enforces TLS in transit
• There is no Backups page for Kafka: the module lists backups only for engines where DigitalOcean provides a list

Running it day to day

• A Clients & Databases panel lists every cluster against the service paying for it, with engine, plan, region, endpoint and state
• An Activity panel records every provisioning and lifecycle action with its outcome
• A report shows your licence, whether a DigitalOcean account is connected and how many databases you run
• A cluster deleted outside your billing system is flagged to you

What your customers get

On Blesta the customer's pages are tabs on the service: Information, Trusted Sources, Backups (where the engine lists them) and Activity.

• Connection details in one window: host, port, username and password (masked until Show, with Copy beside each), plus a ready-to-use kcat command with the SASL_SSL settings filled in
• The CA certificate as a download, for clients that ask for one; the connect command already uses TLS
• Regenerate password in one click behind an in-page confirmation; the new password appears in the connection details
• Trusted sources: add and remove the IPv4 addresses and ranges allowed to connect, with bad entries refused and changes applied within a minute
• Recent activity: their latest actions, up to 40, each marked done or not

The firewall, connection details and backups pages are each a switch on the package: turn one off and it is hidden and refused. The pages render in Blesta's client theme, and every line of customer text is translatable, with overrides that survive updates.

Security built in

• Your DigitalOcean API token is stored encrypted, only ever sent to DigitalOcean, and never shown on a customer page or in a customer message.
• Each database password is stored encrypted and shown only to the signed-in owner of that service.
• Every customer action needs a signed-in owner of the service and a valid security token.
• When something fails at DigitalOcean, the customer sees a neutral message and the reason goes to your activity log.

One product, every feature

PD DigitalOcean Kafka is one paid module with everything included: provisioning, connection details with the CA certificate, trusted sources and password reset. There are no add-on tiers to compare. It installs into PD Modules in one click, updates itself, and uninstalls cleanly: its own tables and settings are removed and no Blesta files are modified.

If your subscription ever lapses, your customers are not cut off. A running database is never stopped, deleted or altered. New provisioning and admin configuration lock first, customers see a neutral "temporarily unavailable" message with their connection details still visible, and cancellations still complete. Renewing restores everything with nothing lost.

Requirements

• Blesta 6.0 or later on PHP 8.2 or later, with the ionCube Loader
• A DigitalOcean account with billing enabled and an API token with Full Access
• Blesta's cron running every minute, which finalises new clusters and confirms cancellations
• PD Modules 0.2.322 or later, the free control panel every PD module installs into