Infrastructure and cloud office

What you end up with

• A cloud office with files, calendars, contacts and video calls, and an ordinary folder on the desktop
• Your own mail server for your domains, with shared mailboxes like info@ or accounts@
• A password manager for the whole team, so credentials stop living in chat threads
• Permissions hang on groups. A new colleague is in with one move, someone leaving is out with one
• Ongoing operation with updates, monitoring and a plan for total failure
• On request a machine with a graphics card in the same rack, running your own language models, with the same backups and the same monitoring
• And whatever is missing after that, we write. That is the part a provider cannot ship you

The material

This is not the offer, it is what we build the offer from. All open source, all replaceable. What comes from us is the setup, the operation, and the software on top that fits it to the way you work.

Nextcloud

Files, calendars, contacts, chat and videoinstead of Drive, Dropbox, Microsoft 365, Zoom, Slack and Trello

Collabora

Office in the browser, documents stay on the serverinstead of Microsoft 365 and Google Docs in the browser

Stalwart

Mail server for your own domainsinstead of Google Workspace, Exchange or mailboxes at your provider

Vaultwarden

Passwords and two-factor codes for the whole teaminstead of 1Password, LastPass or the password in a chat thread

Gitea

Source code, runbooks and versionsinstead of GitHub, GitLab or Bitbucket

Ollama or vLLM

Language models on your own graphics card, wired in like any other service in the buildinginstead of an account with a model provider, billed per request

None of these names ties you down. If a different block fits you better, we use that one. For office work that can mean ONLYOFFICE instead of Collabora, when a lot of heavily formatted Word arrives from outside.

Backup and the way back

A backup is a claim until someone has pulled something out of it. So this says how we do it and what we checked, rather than that we do it.

Three copies, two media, one off site

Local on a separate disk, encrypted at a second provider in the EU, plus a separate emergency store holding nothing but the credentials. Encryption happens before anything leaves the house, so the storage provider only ever sees unreadable blocks.

What gets reported is the silence

Every nightly run has to report in, and a missing report raises the alarm. The usual setup is built the other way round. A backup that stopped running altogether sends no error either.

7 daily, 4 weekly, 6 monthly states

Ransomware often surfaces weeks later. Keep only the most recent state and by then you have long been backing up the damage.

Rehearsed once, for real

We restored the password manager from backup on a machine with no connection to the server at all, opened it and read an entry in clear text. Before that, a restore is guesswork.

The move

The question that comes up most often is what happens to the old mail. Nothing, it comes along. No step starts by switching something off.

1. 1

   Taking stock

   We record which addresses, distribution lists, forwards and out-of-office rules actually exist today. In our experience there are more of them than anyone remembers.

2. 2

   Running in parallel

   The new side is built and filled with the existing data while the old one carries on unchanged. Up to here nobody notices a thing.

3. 3

   The switch

   Only now does anything change over. From that moment new mail arrives at the new server, and the old one stays reachable.

4. 4

   Follow-up and proof

   Signatures, filters and team mailboxes get set up, and we check with real mail in both directions that sending and receiving work. Nothing old is deleted before that is proven.