In a small company, IT usually just happens. Passwords live in a shared spreadsheet and on sticky notes. Files travel by email, and three people each have a different “final version” of the contract. The team talks in a messenger group where a contractor was added once and never removed. PDFs get merged on whatever website the search engine shows first, even when the file is a bank statement. Every tool is a separate subscription, billed per seat.

It hurts most when someone leaves. Nobody knows exactly what they had access to, and half of the work conversations stay on their phone.

All of this can live with you: on a server in the office or one rented at OVH or Hetzner. There is no shortage of open-source software for it. The hard part isn’t installing it, it’s who will update, back up and restore it a year from now. That’s the part we take on.

What we deploy

  • Vaultwarden — a password manager compatible with the Bitwarden apps. A shared organization vault, collections per department, two-factor login.
  • Nextcloud — files, calendars, contacts, shared folders and link sharing. A browser document editor if you need one.
  • Mattermost — team chat with channels, threads and search. History and files stay on your server.
  • Jitsi Meet — video calls in the browser. Guests need no account, just a link.
  • DocuSeal — signing contracts and forms via a link: templates, signature fields, a log of who signed and when.
  • Vikunja — tasks and projects: lists, kanban, deadlines, shared boards.
  • Stirling PDF — merge, split, compress, convert Office to PDF, OCR scans. Files never go to third-party sites.
  • GitLab — for teams that build software: code, CI/CD, wiki.
  • Prometheus and Grafana — monitoring for everything above. When a disk is filling up or a service stops responding, we find out, not your staff.

You don’t have to take everything at once. Most teams start with passwords and files and add the rest once people are used to it.

How it’s built

We install Proxmox VE on the server and split the services into separate VMs or containers. Updating one doesn’t touch the others, and a heavy GitLab doesn’t eat the chat’s memory.

Each service keeps its data on a separate disk, away from the system. That makes it easier to back up, grow and move. A reverse proxy with HTTPS sits in front; for internal services a private certificate authority works fine, no public domain needed.

Access is set up deliberately. Only what has to be public is reachable from outside; the rest is available from the office or over VPN. With many services we add single sign-on, so each employee has one login and offboarding is a single click.

Backups you can actually restore

A backup nobody has ever restored is a hope, not a backup. So:

  • daily copies of VMs and data to separate storage, plus a copy at another site;
  • database dumps that can be brought up independently of the rest;
  • scheduled test restores to a staging box, checking that the service starts and the data is there;
  • you know how much data you could lose in the worst case and how long a restore takes.

How much hardware

Roughly, for an office of 20–30 people. Vaultwarden is comfortable with a gigabyte of RAM. Stirling PDF with OCR wants 2–4 GB. Nextcloud, Mattermost and Jitsi need a few gigabytes each. GitLab is the heaviest at 8 GB and up. The whole set plus monitoring fits easily on one dedicated server with 64 GB of RAM. Without GitLab, a much smaller machine or a couple of VPSes will do.

Honest limitations

  • Email is a separate topic. We do set up your own mail too, but as a separate project: SPF, DKIM, DMARC, IP reputation, anti-spam, migrating old mailboxes. So we plan it apart from the rest of the office, to avoid putting client emails at risk.
  • Jitsi likes bandwidth. Calls with 10+ people need a server with a decent uplink and open UDP ports. Behind a typical office router that isn’t always possible, so Jitsi often goes on a rented server.
  • Nextcloud isn’t Google Docs. Collaborative editing works, but it’s a separate component and needs resources.
  • A server in the office depends on the office. Power, internet, cooling. If those are unreliable, a rented server in a data center is better, with a backup copy kept in the office.

What you get

  • Office services on your own server, with HTTPS and accounts for your team.
  • Admin access and passwords with you, not just with us.
  • Daily backups to a separate site and regularly tested restores.
  • Monitoring and alerts about problems.
  • Scheduled updates of the services and the system.
  • Accounts for new staff and access closed for people who leave.
  • A short guide for your team and documentation of what runs where.

We describe how we set up individual services in the «Офіс без адміна» series on linuxway.com.ua (in Ukrainian): Vaultwarden and Stirling PDF step by step, more to come.

Tell us how many people you have and what you already use, and we’ll suggest where to start.