Configuring computing, storage, and networking for a new server

Decide permanent settings first

Some server properties cannot be changed after provisioning because they appear in attestation records and audit evidence. Changing them requires decommissioning the server and provisioning a replacement.

Confirm the following before you proceed:

• Host name, which appears in attestation and audit records.
• Region, since a host cannot be relocated between facilities.
• Hardware profile, since the profile determines the expected launch measurement.
• Boundary assignment, which determines the control set applying to the host.

Storage profiles

Storage is provided as dedicated local drives rather than shared network volumes. As a result, storage capacity is fixed at provisioning and cannot be expanded later by adding shared resources.

Choose a profile based on your workload characteristics rather than total capacity alone. A profile that delivers the performance you need at 60% utilization is preferable to one that meets your capacity needs at 95%.

Secure erasure of storage at decommissioning is part of your inherited baseline and produces MP-6 evidence automatically. No separate disposal arrangement is required.

Networking and outbound traffic

Each new server connects to a segment defined in your network plan. Segments carry the boundary protection configuration that supports our SC-7 evidence, which is why servers are assigned to planned segments rather than arbitrary addresses.

Outbound traffic is denied by default, and each permitted destination must be declared in advance. This often differs from shared public clouds, where outbound traffic is typically open by default.

# declare an egress destination for a segment
servlogi net egress add \
  --segment seg-prod-app \
  --destination 203.0.113.0/24 \
  --port 443 \
  --justification "vendor API, ticket INF-2291"

The justification field is required for compliance. It is retained and provided during assessment when an assessor asks why a given outbound path exists.