Platform admin

Platform-admin subdomains

Three cross-tenant surfaces moved off the per-tenant app onto dedicated subdomains:

Subdomain Audience What
costs. subdomain Superadmins only Cross-tenant AI + integration spend dashboard. See Cost observability.
infra. subdomain Superadmins only Deep per-env diagnostics — Fly machine list, Redis health, S3 egress, recent deploy commits.
status.luxury.host Public + logged-in operators Health board for prod / preprod / sandbox / demo. See Status page.

Why separate subdomains

Each surface answers questions across all tenants — a per-tenant app shouldn't host cross-tenant data. Separating subdomains:

  • Tenant admins can't accidentally see cross-tenant spend / infra.
  • Superadmins navigate to the dedicated subdomain without bouncing through a tenant context.
  • Each subdomain's auth + routes scope correctly via the platformProcedure tRPC scope.

How auth works

  • status.luxury.host — public landing card; logged-in operators see DB ping + recent incidents; superadmins see the deep diagnostic panel.
  • costs + infra — superadmin login required (Google OAuth same as the main app + the superadmin role check).

The SSO works across all three subdomains — superadmin signs in once at the main app, follows a link to costs or infra, no re-login.

What's NOT on these subdomains

The per-tenant flavors of cost + status remain inside the tenant app:

The platform-admin subdomains add the cross-tenant aggregation only.

Source: the luxury.host operator manual.