Public request
Internet → Cloudflare
:80 / :443
Kamal Proxy
TLS via Let's Encrypt
vault.<domain>
Vaultwarden
docs.<domain>
ONLYOFFICE DocSpace
<domain>, www.<domain>
Your site or app
We deploy every client to the same shape. Not because we lack imagination, because predictability is a feature, and a fleet of one-off snowflake servers is the opposite of reliable.
One client, one server
Every client gets their own Hetzner dedicated machine. Single-tenant. No shared resources with other clients. No “private namespace” in a multi-tenant cluster. The server’s IP, hostname, disk, and CPUs belong to one company.
This is what we mean by self-hosted. It’s also what makes a clean exit possible: when an engagement ends, we hand over root credentials, the data, the backups, the configuration repo, and walk away. Nothing about the architecture forces a re-platforming if a client decides to operate the server themselves.
A single ingress, isolated apps
Kamal Proxy owns the public ports (80 and 443). It terminates TLS via Let’s Encrypt and routes by Host header to whichever application is responsible for that subdomain:
vault.<domain>→ Vaultwarden (password management)docs.<domain>→ ONLYOFFICE DocSpace (documents and collaboration)<domain>andwww.<domain>→ the client’s site or application
Apps run as Docker containers. They don’t see each other’s ports. They share a host, not state. If one app needs to be restarted, the others don’t notice.
Why this shape
It’s debuggable. When something is wrong, the topology fits in one diagram. The path from a public request to an app container is three hops, not thirty.
It’s portable. The whole shape is a few Docker containers, a few configuration files, and a backup. Every piece is open source. If we hand a server to a new operator, they have what they need.
It’s small. Most outages happen at the boundaries between systems. Fewer boundaries, fewer outages. We’ve deliberately chosen a topology that one engineer can hold in their head.
It’s the same as ours. We don’t run a different shape internally. The marketing site you’re reading right now, our project management, our password vault, they all run on the architecture described on this page.