How we run

Kreative Kompas runs on one server in the office. No cloud bills, no vendor lock-in, and every piece is open-source software we can read, fix and improve.

How we run it

The rules that keep a one-server company reliable and safe.

One service, one container

Every app lives in its own container with its own network and database, so one failure stays one failure.

One front door

Nothing is exposed directly. All web traffic enters through the reverse proxy, always over HTTPS.

One login

Team members sign in with a single account. When someone leaves, one switch closes every door.

Admin stays inside

Management tools answer only on the office network or over the staff VPN, never to the open internet.

Secrets out of config

Configuration is shared in Git; passwords and keys live in separate, locked-down files that never leave the server.

Our data, our disks

Mail, files, photos and AI prompts stay on hardware we own, and so do the backups.

A request, step by step

The name resolves. Every public address points at the office connection.
The router lets it in. Only web, mail, VPN, streaming and game doors are open. Admin tools have none.
The front door answers. HTTPS is terminated with a free, auto-renewing certificate and the request is routed to one container.
The team signs in once. Keycloak checks who you are, then every connected app trusts it.
The app does its job. Each app talks only to its own database, on its own private network.

one stack, one folder

# every service is a folder with a compose file
Services/
  wiki/
    docker-compose.yml   # what runs, and how
    .env.example         # which settings it needs
    .env                 # the real secrets, never in Git

# deploy or update a service
docker compose pull
docker compose up -d

53 services, one server

See every one of them, what it does for us and the project behind it.

Browse the services