{
    "product": "Cenvero Stratum",
    "generated_at": "2026-08-03T07:16:48+00:00",
    "format": "cenvero-docs-v1",
    "document_count": 1,
    "documents": [
        {
            "slug": "concepts",
            "title": "Concepts",
            "category": null,
            "url": "https://stratum.cenvero.com/docs/concepts",
            "headings": [
                {
                    "level": 1,
                    "text": "Concepts"
                },
                {
                    "level": 2,
                    "text": "The building blocks"
                },
                {
                    "level": 2,
                    "text": "Addressing"
                },
                {
                    "level": 2,
                    "text": "Overlays"
                },
                {
                    "level": 2,
                    "text": "Policy and protection"
                },
                {
                    "level": 2,
                    "text": "Traffic control"
                },
                {
                    "level": 2,
                    "text": "Routing"
                },
                {
                    "level": 2,
                    "text": "Clustering"
                },
                {
                    "level": 2,
                    "text": "Licence and lifecycle"
                },
                {
                    "level": 2,
                    "text": "Where to go next"
                }
            ],
            "word_count": 1001,
            "markdown": "# Concepts\n\nThe words used throughout these docs, and what they mean in Stratum specifically.\nSeveral are general networking terms that carry a narrower meaning here — those\nare the ones worth reading even if the term is familiar.\n\n## The building blocks\n\n**Node** — one physical server running the agent. Nodes are peers, and there is\nonly one kind: every node hosts workloads and routes. What differs between two\nnodes is the interfaces they hold and what you have put on them — see\n[Nodes and Interfaces](/docs/nodes).\n\n**Network** — a subnet the fabric carries, with its own address range, gateway,\nand policy. This is the unit you create first and attach everything else to. A\nnetwork can exist on one node or stretch across many.\n\n**Endpoint** — the attachment point where a workload joins a network. It has an\naddress and a hardware address, and the fabric enforces both: traffic claiming to\ncome from an endpoint must actually match its registration.\n\n**Tenant** — an ownership boundary. Networks, endpoints, and bandwidth allowances\nbelong to a tenant, which is what lets one node carry several customers' traffic\nwithout them reaching each other. Suspending a tenant affects everything under it\nat once.\n\n**Workload** — whatever is using an endpoint: a virtual machine, a container, or a\nphysical host on a port.\n\n## Addressing\n\n**IPAM** *(IP address management)* — the record of which addresses in a network are\nallocated, reserved, or free. Reservations tie an address to a specific hardware\naddress so a workload always gets the same one.\n\n**Floating address** — an address that is not permanently attached to one node.\nIt lives on whichever node currently holds a role, and moves when that role moves.\nThis is how gateway failover keeps a stable address.\n\n**VIP** *(virtual IP)* — the address clients connect to for a load-balanced\nservice. The load balancer accepts traffic on the VIP and distributes it to\nbackends.\n\n## Overlays\n\nThese four terms describe one mechanism, and they are easy to confuse.\n\n**Underlay** — the ordinary network that already connects your nodes. Whatever\ncarries traffic between their real addresses.\n\n**Overlay** — a network Stratum builds *on top of* the underlay so that workloads\non different nodes appear to share a subnet. It exists only as far as the nodes\nare concerned; the underlay sees only traffic between nodes.\n\n**VNI** *(virtual network identifier)* — the number that identifies one overlay.\nNodes sharing an overlay must use the same VNI; different overlays use different\nones, which is what keeps them separate over the same underlay.\n\n**VTEP** *(tunnel endpoint)* — the address a node sends and receives overlay\ntraffic from. In practice this is the node's own address on the underlay. Each\nnode must know the others' VTEPs, or it has nowhere to send overlay traffic — see\n[Networking Overview](/docs/networking/overview).\n\n**Encapsulation** — wrapping an overlay packet inside an underlay packet for the\ntrip between nodes, and unwrapping it on arrival. This is why an overlay packet is\nslightly larger than the payload it carries, and why overlay networks want a\nlittle headroom in the underlay's maximum packet size.\n\n## Policy and protection\n\n**Rule** — one firewall decision: match traffic by direction, address, protocol\nand port, then allow or deny it. Rules are evaluated in priority order.\n\n**Default action** — what happens to traffic no rule matched. Set it to deny for a\nzero-trust posture, where traffic is refused unless something explicitly permits\nit. See [Zero-Trust Firewall](/docs/networking/firewall).\n\n**Stateful** — a firewall that remembers established conversations, so replies to\ntraffic you allowed are permitted without a matching rule in the other direction.\n\n**Connection tracking** — the table of those remembered conversations. It is worth\nknowing this exists because it explains a common surprise: tightening a rule\naffects *new* connections, while ones already established keep going until they\nend or are flushed.\n\n**Anti-spoofing** — enforcing that traffic from an endpoint carries that\nendpoint's registered addresses, so one workload cannot impersonate another.\n\n**Block list** — addresses refused outright, checked before the rules.\n\n## Traffic control\n\n**Shaping** — limiting how much bandwidth something may use. Applied on the way\nout of an interface.\n\n**Quota** — a cap on total volume over a period, as opposed to a rate limit.\n\n**Accounting** — the record of how much traffic something actually used, which is\nwhat billing integrations read.\n\n## Routing\n\n**BGP** — the protocol nodes use to exchange routes with your upstream routers, so\nthe rest of your network learns how to reach the fabric.\nSee [BGP Edge Routing](/docs/networking/bgp).\n\n**Peer / neighbour** — the router on the other end of a BGP session.\n\n**Announce** — offering a network to your peers, so traffic for it is sent to this\nnode.\n\n**NAT** *(network address translation)* — rewriting addresses in transit. Two uses\nhere: letting many private workloads share one public address on the way out, and\npublishing an internal service on a public address and port. See\n[Gateway NAT](/docs/networking/gateway-nat).\n\n## Clustering\n\n**Cluster** — nodes that share configuration and coordinate with each other.\n\n**Leader** — the member that currently accepts changes to shared state. Chosen by\nelection; losing it triggers a new election and does not stop traffic.\n\n**Heartbeat** — the frequent signal between two nodes paired for high\navailability, so each knows the other is alive. Missing several in a row is what\ntriggers failover.\n\n**Failover** — a standby taking over from a failed peer, including the floating\naddress.\n\n## Licence and lifecycle\n\n**Activation** — binding a licence to one specific machine. A licence covers a\nnumber of machines; each is activated separately.\n\n**Enforcement state** — how the agent is currently treating the licence: *active*,\n*warning* as expiry approaches, *grace* just past it, and *frozen*. Frozen blocks\nchanges only — traffic never stops. See [Licensing](/docs/licensing).\n\n**Release channel** — whether a licence runs released builds or pre-release ones.\nThe two must match, and the agent refuses a build from the wrong channel.\n\n**Manifest** — the signed list of available releases the agent checks when looking\nfor an update.\n\n## Where to go next\n\n- **[How Stratum Works](/docs/architecture)** — how these pieces fit together.\n- **[Quick Start](/docs/quickstart)** — put the main ones to use.\n- **[CLI Reference](/docs/cli)** — the commands behind each concept.\n"
        }
    ]
}