One person, a hundred apps, my own hardware

The situation

Most companies do not have an infrastructure problem. They have a sprawl problem. Every team signs up for its own tool on its own account with its own login, billed to somebody’s card. A few years later nobody can tell you what is running, who can get into it, or what breaks when the person who set it up quits. I have walked into that mess more times than I can count.

So I built the opposite of it, on purpose, and I run it for real. It is the back end for every site I run and it is the working example of the hosting I sell. Every part of it was built to be found, not guessed at, which is the only reason one person can hold the whole thing in their head.

What is actually running

One front door. Every public address on my servers ends at one program, Caddy. It gets the security certificates itself and sends each address to the right app. Traffic comes in through a Cloudflare Tunnel, so there is no open port on the internet for anyone to poke at. Adding a site is one block in a config file and a reload.

One login. Every app signs you in through the same login system, Authentik. One account and one set of rules instead of a hundred separate passwords. Anything private is locked at the front door and at the login both. Hit a private tool without signing in and you get a login page, not the app.

One setup tool. A control plane takes a brand-new VPS from blank to fully set up: certificates, single sign-on, the apps, all of it, with no steps done by hand. Each job gets its own one-time key, it checks that everything is healthy before it calls the job done, and it can roll itself back. The same tool that sets up my own servers sets up a customer’s beacon.

Security that actually runs. Break-in detection and weak-spot scanning run on every host: a central log system, host monitoring, a guard at the edge that blocks attackers, and scheduled scans. None of it is a box ticked for an audit. It runs every day and it pages me when something is wrong.

One data pipeline. Data moves through in real time instead of sitting in a database. Content comes in through Kafka, gets processed with Apache Flink, and small Python programs call a local AI model on my own graphics cards to detect the language, translate it, and score each record. Late data is handled correctly. Most shops rent this from a vendor and never see inside it. Mine runs on my own hardware, so the model, the data, and the bill stay in one place I control.

How I keep it honest

A setup this size drifts the second you stop looking at it. So I do not trust my memory of what is running. I check the live system. A build fails if a new site shows up that nobody declared. The setup tool checks health before it reports done. Last time I audited everything end to end, the one thing out of place was a web address pointing at an app that still answered under its old name. Login worked, but the switch had never been finished. I only caught it because I tested the real thing instead of reading the note that said it was done.

And you can leave. Every app is open source and the data exports. I built it so a customer, or whoever runs it after me, can take their setup and walk. Hosting you cannot leave is a hostage situation, not a service, and I will not sell one.

Why it matters

This is the “build it” door with the receipts attached. It is not a drawing of what I could set up for you. I run this right now, with real users, real secrets, and real consequences when it breaks. Most people who can design a login system have never pulled a cable or carried the pager. Most people who carry the pager did not design the system. Here it is one person from the front door to the backup job.

If your company has more running than anyone can account for, that is the problem I fix. Not with another tool. By making what you already have easy to see, actually owned, and safe to hand to the next person. It is the same job as the door buzzer, just bigger: find out what is really there, test it instead of assuming, and leave the next person the map I never got.