What runs on a node

The substrate is everything the platform itself runs: the control plane, its database and secrets store, the network and hypervisor services, the DNS and load-balancer data planes, and the monitoring stack. Platform services run as podman containers managed by systemd (quadlets); the host services are native systemd units.

Console: Admin › Substrate › Overview sums up their health.

The Substrate overview.

The services

Service	Unit	Does
Control plane	stratum-controlplane	The API, the console’s backend, and the reconcilers that converge every resource.
Console	stratum-ui	The web console.
Postgres	postgres	The control plane’s database: every resource record, user and policy. On a cluster, Patroni runs it with a replica on every control-plane node.
OpenBao	openbao	The secrets store: encryption keys, the cluster’s certificate authority, the SSH CAs, credentials.
OVN central	stratum-ovn-central	The network’s desired state (northbound) and its programmed flows (southbound).
OVN controller, Open vSwitch	ovn-controller, openvswitch	Program the node’s virtual switches from OVN.
libvirt / QEMU	virtqemud	Run the instances.
Host helper	stratum-host-helper	The root-side agent: applies what the control plane asks of the host (network namespaces, routes, data-plane containers, the host reservation, firewall guard) and reports the node’s hardware and release.
DNS	axdnsd	The authoritative DNS for the cloud’s names.
Front door	axlbd-stratum-front	The platform’s own load balancer: the API over TLS and the admin tools by name.
Metrics	victoriametrics, vmagent	Store and scrape metrics.
Logs	victorialogs, otel-collector	Store and collect logs.
Traces	tempo	Store traces of the platform’s requests.
Alerting	vmalert, alertmanager	Evaluate alarm rules and deliver notifications.
Exporters	node-exporter, process-exporter, postgres-exporter, libvirt-exporter	Host, process, database and hypervisor metrics.

On a cluster

Postgres, OpenBao and OVN central run on every control-plane node and elect leaders. See the cluster at a glance to read who leads what.

Data planes

Some services run per tenant resource, placed by the control plane and started by the host helper:

Data plane	One per	Runs
VPC resolver	VPC	A recursive DNS resolver in the VPC’s own network namespace, at each subnet’s .3.
Load balancer	Load balancer	An axlbd container with a NIC in the tenant’s subnet.
Metadata service	VPC	The instance metadata endpoint at 169.254.169.254.

How the pieces work together

1. A request to the API is recorded as desired state in Postgres and answered at once.
2. Reconcilers in the control plane converge each resource toward its desired state: they write OVN, call libvirt, and leave intents for the host helper.
3. The host helper applies intents on the host and reports back.
4. Every node reports its own state; nothing is probed from another node.

Reconcilers run continuously, so a change made outside the API, or a failure, is corrected on the next pass. Their status is under Substrate services.

Where things live on a node

Path	Holds
/etc/stratum/node.yaml	The install configuration.
/etc/stratum/secrets/controlplane.env	Control-plane secrets, root only.
/var/lib/stratum/	Platform state: database, secrets store, host-helper state, upgrades, backups.
/var/log/stratum/install.log	The install log.