The stack
11 components in 3 bundles — what each one does, the shapes it deploys in, and the caveats stated here instead of discovered in month three. Every one of them runs on infrastructure you control, and nothing here phones home to us.
- Built
- 04
- Running today, with the upstream projects they are assembled from published on this page.
- Designed, not yet built
- 07
- Named, scoped and on the page before they exist, not after.
- 01WATCHTOWERThe operations centre.SENTINELNIGHTWATCHSENTRYCHECKPOINT
- 02BURROWYour code, your files, your photos.ARSENALCACHESWITCHBOARDDARKROOM
- 03DEEP COVERFor when the network can't be trusted.GHOST PIPELINEDEAD DROPIRON DEN
- Grafana
- Prometheus
- OpenSearch
- Keycloak
- NGINX
- Let's Encrypt
The operations centre.
The four that answer the questions that matter at 2am: what is running, what changed, who got in, and what left. All of it fits on one box.
Metrics, logs, and dashboards you'll actually open. Warns before a disk fills.
BuiltGrafana · Prometheus · Loki · Promtail · node_exporter · cAdvisor · Alertmanager
Seven containers. The heaviest thing in the baseline.
No host to measure on managed containers, so platform metrics replace host metrics.
Watches every host for the events that matter, tuned until an alert means something.
BuiltWazuh manager · Wazuh indexer · Wazuh dashboard · Wazuh agents
The indexer is an OpenSearch fork and wants real memory.
One front door. Single sign-on and MFA in front of everything behind it.
BuiltKeycloak · Nginx
One front door. Everything else authenticates through it.
DNS filtering, TLS, and egress default-deny. Decides what gets to leave.
BuiltBlocky DNS · Nginx · Let's Encrypt · nftables
DNS filtering, TLS termination, rate limiting, egress default-deny.
In your cloud, filtering uses the platform DNS firewall — one container as the whole VPC resolver is a blast radius nobody wants.
Your code, your files, your photos.
The things you are currently renting from somebody who reads them. Pull them back onto hardware you own, behind your own front door.
Your repositories, reviews, and build history on your own metal.
Sync and share behind your own identity gateway. Files only, not groupware.
Team chat and calls on your own server. Federate with the wider network, or seal it inside your boundary.
Federation needs a reachable name and a TURN server for calls. Sealed inside a boundary it needs neither — that is the simpler build, and the one most people actually want.
Photo and video library with search and phone apps, on storage you own.
Not sold managed. Four upstream auth and sharing flaws in fourteen months, and family photos are the wrong place to find the fifth. Free baseline only.
For when the network can't be trusted.
Provenance for what you ship, backups nothing can delete, and inference that never leaves the building. Scoped per environment.
Signed builds and dependency inventory. Prove what shipped and what was in it.
Verification runs anywhere. The build side needs an instance to build on.
Append-only backups nothing can delete, and restores that get rehearsed.
In your cloud this becomes truly immutable storage. The offline-mirror half is on-prem only.
Language models running inside your own network. Nothing leaves the building.
The three deployment shapes
The shape markers above mean something specific. Each component lists the shapes it is actually offered in — and where a shape has a limit, the limit is printed on the component rather than papered over.
- 01Available
YOUR METAL
On hardware you can physically touch.
Compose and Ansible onto machines you own — a rack, a closet, a couple of mini PCs, or a plant-floor box that never sees the internet. Every component is available in this shape and this is the only shape that supports fully air-gapped work.
- All components available, including air-gap and offline mirrors
- No cloud bill and no third-party dependency
- You own the hardware lifecycle — that's the trade
Best for: Anyone who wants the whole thing under their own roof
- 02Scoped, not yet deployed
YOUR CLOUD · INSTANCES
Templated into your own AWS account.
Scoped, not yet run in a client environment. A CloudFormation template will stand the stack up on instances inside your account, your VPC, and your billing — you would hold the root credentials and the data would never leave your tenancy. The design is done; the first deployment is not. Ask where it stands before you plan around it.
- Designed to deploy in your account, your VPC, under your own billing
- Intended to carry every component, including host-level monitoring
- Storage on your volumes, secrets in your own secret store
Best for: Commercial clients standardised on AWS
- 03Planned
YOUR CLOUD · CONTAINERS
Managed containers, less to babysit.
Not built yet. The intent is that the stateless parts of the stack run as managed container services in your account, with persistent data on your own volumes. A few components genuinely need to see the host they are watching and would stay on instances regardless. This shape is on the roadmap, not on the shelf — do not scope work against it today.
- Intended fit: observability, identity, perimeter, and pipeline components
- Host-visibility components would stay on instances — an honest limit, not a gap
- Would deploy as a hybrid: containers where they fit, instances where they don't
Best for: Teams already running containers who want less to patch
The baseline is free.
The single-node stack, the audit tool, the build guides, and the weekly dispatch cost nothing and aren't gated. No asterisk. If you run it yourself and never get in touch, that's a perfectly good outcome.