This page is served by a NixOS system running inside a Kata Containers microVM with hardware isolation. The entire system — OS, services, configuration — is defined in a Nix flake and deployed as a single OCI image.
Each VM gets a virtual TPM backed by swtpm on the host. At first boot, an age identity is generated from the TPM. Secrets are encrypted with sops and decrypted at boot by sops-nix using the TPM-backed age key. No secret material touches disk unencrypted.
Single bare-metal node. Dual-stack IPv4 + IPv6. MetalLB for LoadBalancer services. Every pod runs in its own hardware-isolated VM — there is no shared kernel between tenants.