charizard

mjm.vault.enable = true;

charizard is one of three VMs running Vault in a Raft cluster together. One Vault VM can be unavailable without disrupting the functionality of the other two.

mjm.vault.encryptedUnsealTokens = [
  ''
    Whxqht+dQJax1aZeCGLxmiAAAAABAAAADAAAABAAAAAdsLOZ2ZFiYZN0XU8AAAAAEpRFRqw3McTyf7x
    rXPn6Dv4SokbTBWQ3yx02yZXOyArY6653La1YsbTZTa6DT41K+/M28B0uLHUceGAPINmhuoIOvC0pbc
    JAy2Xvq4IYTu9FBtGstJhJ8SjyMdw=
  ''
  ''
    Whxqht+dQJax1aZeCGLxmiAAAAABAAAADAAAABAAAABrzMH4oz+RtQLQbQYAAAAAjLuXezykJgOgNlu
    m/3V/ZCsW3c3w4/zloP4cWYCfn3l5/oFF1aNpH1Rcr4/utNMUjyEfEO9R4P2DNRb4sePxhouc3aL+uP
    BodHa+8YVoA7/JToLYFYZYFWRyuig=
  ''
];

Each Vault VM also runs vault-unseal which will automatically unseal the Vault nodes when needed. Three keys are needed to unseal a node, so each node is configured to have two of the three keys. Any two nodes being up is sufficient to have all three keys and unseal automatically. The keys are encrypted using systemd credentials.

microvm.mem = 1024;

charizard runs with increased RAM.

{
  microvm.vms.charizard.config = {
    <<config>>

    mjm.profiles.microvm = {
      enable = true;
      macAddress = "02:14:FA:BA:5C:EE";
      machineId = "ac0eae02dc9736531b8ab69d6820a942";
      group = "early";
    };
    microvm.vsock.cid = 106;
    system.stateVersion = "25.05";
  };
}