This is the platform template we deploy. It is not a catalogue of things we like — it is the actual stack running on our own infrastructure and on client installations, documented component by component.
Each entry tells you what the program does, which features matter in daily operation, why we chose it over the alternatives, and where its official documentation lives.
How those components are wired together — the host, the containers, the identity layer and the encrypted backup path — is drawn on the project diagram.
Design rules
Five rules decide what enters the template and what does not.
A component is only added when it closes a gap the current stack leaves open. Fewer, well-understood components beat a rich stack nobody can maintain. If a control only works when people remember to use it, it does not work. Encryption, backups and access rules are configured so the correct behaviour is what happens automatically. Every service is defined in a versioned file. A host can be provisioned from the repository without a migration project — that property is what keeps the platform affordable over years. We use open formats and open protocols. Files stay readable, exports stay possible, and no single vendor can change the terms of the relationship unilaterally. An untested backup is a hope. Every installation runs at least one real restore drill, and the backup age is monitored as a first-class metric.One tool must cover something the existing ones do not
The secure path must be the default path
If it cannot be rebuilt, it is not a platform
The operator must be able to leave
Backups are rehearsed, not assumed
The capability areas
Identity & Access
One account for every service. Central authentication, single sign-on and encrypted remote access.
Collaboration & Productivity
Files, documents, knowledge base and design workspace — shared, versioned and under your own control.
Documents & Data
Paperless archiving, PDF tooling and the databases that carry the whole platform.
Infrastructure & Automation
Containers, reverse proxy, virtualisation and the automation that makes the stack reproducible.
Communication
Corporate mail, webmail, newsletters and push notification — without handing data to third parties.
Monitoring & Security
Metrics, dashboards, uptime checks and security event correlation across every host.
Backup & Recovery
Encrypted, deduplicated backups following the 3-2-1 rule, with a rehearsed restore procedure.
All components
ONLYOFFICE Docs
Collaborative office suite inside the file platform
View details
Docker Engine
Container runtime for every service on the platform
View details
Traefik
Reverse proxy, TLS termination and automatic certificates
View details
nginx
Web server and TLS endpoint inside service containers
View details
Ansible
Infrastructure as code and configuration management
View details
Proxmox VE
Virtualisation platform for on-premise workloads
View details
Wazuh
SIEM, file integrity monitoring and vulnerability detection
View details
Object Storage Targets
Two independent off-site locations for the 3-2-1 rule
View details
Want this template for your organisation?
We scope, install and hand over a documented platform — or operate it for you.