Start from home, then cross-read Frankfurt AWS eu-central-1 and Dublin vs London registry routing when you also touch hyperscaler edges. Freeze probe scripts before Germany purchase or pricing sign-off.
- Pain 1: APAC SSH latency and EU API latency get averaged into one slide—auditors cannot see responsibility boundaries.
- Pain 2: Hetzner and Scaleway control planes share a chart even though TLS chains and maintenance windows differ.
- Pain 3: Sixteen-gigabyte leases swap during Terraform plans while yellow API rows blame the network.
Frankfurt to Hetzner and Scaleway: common API RTT threshold table
Run probes on the dedicated Germany Mac, not a laptop in Singapore. Keep object storage and registry hostnames on separate rows—this table targets REST control planes only.
| Endpoint (from DE Mac) | Green p95 TTFB | Yellow | Red action |
|---|---|---|---|
| api.hetzner.cloud | 8–18 ms | 19–42 ms ×3 days | DNS, PAC, token log disk writes |
| api.scaleway.com | 10–22 ms | 23–48 ms | Split curl tcp / tls / ttfb columns |
| registry.scw.cloud (pull smoke) | +12–35 ms vs API | >2× API p95 | Mirror or regional registry project |
| APAC → SSH entry (segment A) | <220 ms interactive | >400 ms | Do not add to EU API rows |
Data residency and log redaction routing
Low RTT does not prove residency. Route state and backups to the EU project/region named in your DPA, and keep the Mac as a build and orchestration surface only.
| Traffic class | Preferred path | Log rule |
|---|---|---|
| VM lifecycle API | DE Mac → Frankfurt corridor → vendor EU API | Redact API tokens; store request id only |
| Object storage | Same region as bucket (fsn1, par, ams) | No pre-signed URLs in syslog |
| Diagnostics export | EU SIEM endpoint from allowlist | 30/90d retention per policy ticket |
Pair routing with EU egress and log redaction so outbound defaults stay deny-first.
M4 16GB vs 24GB and storage expansion lease matrix
Memory and disk are fixed at order time. Tie tenure to RSS and image cache size, not list price alone.
| Profile | 16GB + 512GB | 24GB + 1TB | Tenure hint |
|---|---|---|---|
| Light CLI + curl patrol | Proof lease 2–4 weeks | Optional | Monthly renew until p95 stable |
| Xcode + two container agents | Yellow under parallel pulls | Quarterly or annual | Add disk if registry layers >120GB |
| OpenClaw + hcloud CLI | OK for single runtime | Preferred for doctor CI | Bundle RAM upgrade with egress change |
SSH entry and collaboration session recommendations
- One primary SSH entry per team on the Germany host; document bastion vs direct in the same change bundle as API probes.
- tmux or screen for long Terraform plans so APAC disconnects do not orphan state locks on Hetzner.
- Separate keys for human admins vs automation; rotate on the same cadence as cloud API tokens.
- VNC only for GUI acceptance tests; keep API automation on SSH with audit-friendly session logging.
OpenClaw EU outbound allowlist and doctor compliance acceptance
Default-deny egress must list api.hetzner.cloud, api.scaleway.com, and registry hosts your pipelines need—version the YAML beside admin vs runtime split.
- Label segments: Prefix logs with
SEG-A-SSHvsSEG-B-EU-APIbefore archiving weekly CSV. - Hetzner curl:
curl -sS -o /dev/null -w 'tcp:%{time_connect} tls:%{time_appconnect} ttfb:%{time_starttransfer}\n' https://api.hetzner.cloud/v1/servers— two hundred samples; yellow if p95 ttfb >42 ms. - Scaleway curl: Same pattern against
https://api.scaleway.com/— do not merge CSV files with Hetzner. - Registry smoke: Time a small manifest pull; red if pull p95 exceeds 2× control-plane p95 for three days.
- openclaw config validate plus
openclaw doctor --non-interactive— stop release if doctor fails even when API rows are green. - Lease hook: Attach CSV paths and chosen RAM tier to the change record before extending tenure on pricing.
Citable thresholds
- 200 HTTPS samples per vendor endpoint before procurement sign-off.
- 6 ms week-over-week drift on the same probe → routing ticket before RAM upgrades.
- 42 ms Hetzner API TTFB p95 yellow ceiling (tenant-tunable).
- 400 ms APAC SSH interactive red line—never blend into EU API tables.
FAQ
Lock Frankfurt-path probes, then lease dedicated M4 metal
After SEG-B API rows stay green, read AWS eu-central-1 or Dublin corridor guides if you also use hyperscaler edges—then checkout on Germany purchase and confirm SSH in help.