Operations | Machina

📄️Configuration

Daemon config.toml, controller environment variables and install paths.

Prometheus metrics, OTLP export, Linux pressure signals and fleet-wide scrapes.

Authentication, RBAC, audit, TLS and how to report vulnerabilities.

The production security profile, secret and key lifecycle, audit retention and the mandatory eBPF gate.

Upgrade Machina in place, back up VMs and controller state, and roll back.

The first checks to run, and fixes for the most common problems.

Symptoms, causes and fixes for bare-metal provisioning.

Label hosts with a site and rack, spread anti-affinity groups across racks, and check whether HA could restart a lost rack.

Run Machina with no route to the internet - what to mirror, which settings point at your mirror, and how to prove nothing leaves the site.

Split a GPU into mediated-device partitions and give each to a VM, instead of passing the whole card through.

Create VMs with UEFI Secure Boot enforced and an emulated TPM 2.0, the combination Windows 11 and hardened Linux images expect.

Create, scale, upgrade and delete k3s clusters across enrolled hosts from the controller.

Clone a template VM into a pool of desktops, hand one to each user who checks out, and recycle it when they are done.

Copy backups to an S3-compatible store at another site, verify them, and pull one back for a restore.