The whole platform on one canvas: host, containers, identity, security controls and the encrypted backup path.
The platform on one page
This is the architecture we actually run on our own infrastructure — the same template we deploy for clients, drawn as it is rather than as a slide. Nothing here is illustrative: every container, database and backup target in the diagram exists in the running stack.
Flow
Legend
Public request path (HTTPS)
Authentication against the identity provider
Database and cache access
Metrics, checks and alerts
Encrypted backup to two off-site targets
Tip: click a component for its role, features and official documentation.
Security controls
Security that depends on someone remembering it is not security. These eight controls are configured so the safe path is the default path, and so each of them can be verified rather than assumed.
1
TLS 1.3 everywhere
Every published hostname carries a valid certificate that renews itself. Nobody tracks expiry dates in a spreadsheet.
2
Single sign-on
One identity provider for every service. Joining and — more importantly — leaving happens in one place.
3
Encrypted admin tunnel
Administrative interfaces are never reachable from the internet. They sit behind WireGuard keys, not passwords.
4
Minimal exposure
Only 443, 993 and 465 are published. Everything else stays inside the Docker network.
5
Mail authentication
SPF, DKIM and DMARC are configured and verified, so mail from your domain cannot be spoofed quietly.
6
Encrypted backups
Archives are encrypted on the client before they leave the host — the storage provider never sees plaintext.
7
File integrity monitoring
Wazuh watches the critical paths and reports unexpected change, instead of assuming it would be noticed.
8
Reproducible host
Every service is a pinned container defined in a versioned file. The host can be rebuilt from the repository.
Want this architecture for your organisation?
We scope, build and hand over a documented platform — or operate it for you.
