Substrate

Substrate Architecture #

Within a site, the substrate provides the shared infrastructure foundation — networking, compute, and services, all defined as code. The substrate is stateless — all configuration lives in source control and is applied through automation, so it can be reprovisioned from scratch at any time.

For site definitions (home, mobile) and the independence model, see Architecture.

Infrastructure Layers #

block-beta
    columns 2
    hdr["Substrate Infrastructure"]:2
    net["Network"]:1 netd["Routing · Firewall · DNS · DHCP · NAT · Switching · Wireless"]:1
    cmp["Compute · Storage¹"]:1 cmpd["Hypervisors · Persistent storage"]:1
    mcp["Management / Control Plane"]:1 mcpd["Network management · Observability"]:1

¹ Shared storage is a planned future addition.

Network #

Connectivity, segmentation, and the foundational network services. Nothing else in the substrate has to be running for these to work:

  • Routing and gateway: NAT, inter-segment routing, upstream connectivity
  • Firewall: segment isolation and egress policy
  • DNS: authoritative resolution for the substrate zone
  • DHCP: static mappings for known hosts, dynamic pools per segment
  • Switching and wireless: VLAN trunking and wireless access

See Networking for substrate networking services. See Network Segmentation for the segment model and trust hierarchy.

Compute and Storage #

Compute is the virtualization hosts: a management hypervisor for the management / control plane, and workload hypervisors for what runs on the substrate. See Compute.

Storage¹ is shared and persistent storage for substrate consumers. See Storage.

Management / Control Plane #

The services the substrate runs on its management hypervisor to manage and observe itself: network device management and substrate observability. See Management / Control Plane.

Child Documents #

Page last modified: September 16, 2026