We build and operate infrastructure as a whole rather than selling individual settings: the cloud and storage, the edge, mail, applications, and everything that watches them. Below is the full list of what we take on.
Packages with a price
Six ways in, each with its own page, timeline and number. Everything else in the catalogue attaches to one of them, or is quoted on its own.
The rest of the catalogue carries no list price, and that is not evasion: the number depends on what is already in place, how many domains and hosts there are, and what state they are in. So every engagement starts with the audit, which fixes a price before anything else is agreed. Several of these areas are part of the retainer and cost nothing on top.
We pick the provider to fit the job and the budget. The servers and the provider account are in your name: if we stop working together, you do not have to move away from the provider too.
Hetzner
Dedicated servers and cloud in Germany and Finland. The best hardware for the money under Ceph and OpenNebula.
OVHcloud
Dedicated servers in Europe and North America, DDoS protection included, vRack for a private network between servers.
Selectel
Data centres in Russia, for when personal data must stay in the country under Federal Law 152-FZ. Dedicated servers and S3.
AWS
When you need managed services or a worldwide footprint. We read the bill and build a hybrid with your own cloud.
Others, and your own hardware
Timeweb Cloud, Yandex Cloud, Leaseweb, colocation with servers you own — as long as the site has a sound network and console access.
What that covers
10 · 75 line items
Clouds and storage8
Your own cloud on dedicated servers, S3 without an egress bill, and AWS where it is actually needed.
A private cloud on OpenNebula and KVM: VMs, networks, quotas, templates and an API for team self-service
Ceph: block storage for VMs (RBD), object storage (RGW) and CephFS — with the replica count sized to your risk
S3-compatible storage on Ceph RGW or MinIO, with a key per application and bucket policies
Servers at Hetzner, OVH, Selectel and other providers: hardware chosen for you and ordered on your account
AWS: reading the bill, storage classes, reserved capacity, and moving out what is cheaper on your own servers
Hybrid: a private network between your cloud, AWS and the office, with one set of access rules
VM and bucket migration between providers, verified for integrity, with the old path live until cutover
A second site at a different provider, so one data centre failing does not become your outage
Applications: speed and hardening10
PHP, Node.js and Python on the server — faster, and with no doors left open.
1C-Bitrix: composite mode, component caching, agents on cron, BitrixVM or a lean environment of your own
WordPress and WooCommerce: object cache, heavy plugins, wp-cron, xmlrpc and wp-admin closed
Laravel and Symfony: queues, config and route caching, workers under supervision rather than in screen
PHP-FPM and OPcache sized to real memory and load, PHP version upgrades checked for compatibility
MySQL, MariaDB and PostgreSQL: slow query log, indexes, buffers and replication
Redis or Valkey for sessions and caching, nginx for static files, compression and HTTP/2
Hardening: file permissions, open_basedir, disable_functions, .git, .env and backups out of the web root
Malware found and removed, and the way in closed so it does not come back a week later
A load test before a sale or a launch: find the ceiling before your customers do
Node.js and Python in the same order: measure, profile, database, cache, configuration, hardening
Edge and publishing8
Everything between the internet and your application, run as one layer.
HAProxy and OpenResty in front of the application, with the origin unreachable from the internet
TLS 1.3 and HTTP/3, certificates issued and rotated without your involvement
WAF in blocking mode, rules tuned to your traffic rather than left on a vendor default
Per-route rate limits, connection limits, and a circuit breaker for upstreams that stop answering
GeoIP routing and blocking where the business actually needs it
Branded error pages, so a 502 does not look like a broken server
Structured access logs shipped to storage you control, with the real client IP preserved
Cutover from your current entry point in a window you pick, old path kept until you drop it
Mail8
Your own mail server, and mail that actually arrives.
Postfix, Dovecot and Rspamd deployed and operated, multi-domain from the start
SPF, DKIM and DMARC published correctly and verified against the major receivers
Sender reputation watched, and the work of getting unblocked when it slips
A separate sending domain for transactional mail, so marketing cannot take down password resets
Webmail, calendars and contacts (CalDAV/CardDAV), with autoconfig for Apple Mail and Thunderbird
Migration of existing mailboxes from Google Workspace, Microsoft 365 or another provider
Shared archive for compliance, with retention you define
Antivirus and spam filtering on the way in, rate limits on the way out
Code, CI and delivery8
Your own forge and pipelines, on your own hardware.
Self-hosted Forgejo, Gitea or GitLab, deployed and kept upgraded
CI runners that build on your machines instead of someone else's minutes
Container registry and artifact storage, with retention that does not grow forever
Pipelines for test, build and release, including signed tags and changelogs
Deploy automation to your servers, with the same playbooks we run ourselves
Secrets kept out of the repository, in a vault the pipeline can read and you can audit
Mirroring to or from GitHub when a public face is still needed
Migration from GitHub or GitLab.com, with issues and history intact
Observability7
Knowing something broke before the customer tells you.
VictoriaMetrics and Grafana for metrics, Loki and Vector for logs, on your infrastructure
Host and service exporters, so capacity questions have numbers behind them
Blackbox probes for every public name you own, including certificate expiry
Alert rules that fire on the things that actually page a human, routed to where you read them
Dashboards built around your services, not an imported template nobody opens
Log retention sized to what you need to answer, not to what the disk allows
Uptime and incident reporting you can show a customer
Access and hardening8
Taking the servers off the public internet, and keeping named people in.
A private mesh across your hosts on Headscale or WireGuard, with its own control plane rather than a vendor's
SSH closed to the internet and reachable only over the mesh, through a bastion if you want one
Per-person access with named keys, so revoking someone is one command and not an archaeology project
Single sign-on with Zitadel in front of internal tools, instead of a shared password in a chat
Baseline hardening of every host: nftables, AppArmor, auditd, fail2ban, kernel and sysctl settings
Unattended security upgrades with a reboot window you choose
Periodic scanning with Lynis, rkhunter and ClamAV, with the findings triaged rather than mailed to nobody
An honest report of what is exposed, which is where most engagements start
Data and backups6
Backups that have been restored at least once.
PostgreSQL and Redis deployed, tuned and monitored, not left on defaults
Borg or Restic to storage you own, encrypted, with retention that matches the obligation
Restore drills on a schedule, because an untested backup is a belief, not a backup
Point-in-time recovery for the databases that warrant it
Offsite copies, so one provider losing a region is not your incident
Documented recovery procedure your own team can follow without us
Runtime and automation6
The machines underneath, described in code rather than in someone's memory.
Every host described in Ansible, so rebuilding one is a playbook run and not an afternoon
Docker and Compose for single-host services, k3s where a cluster genuinely earns its keep
Provisioning on your provider of choice, or on hardware you already own
Staging that matches production closely enough to be worth having
Runbooks for the things that go wrong, written before they go wrong
Onboarding of existing servers: we adopt what you have rather than insisting on a rebuild
Tooling we bring6
Software we wrote and run ourselves, deployed on your infrastructure instead of rented per seat.
Heartbeat monitoring for cron jobs and backups: a job that stops running raises an alert instead of being noticed a month later
A support desk with a knowledge base, file attachments and routing rules, on your domain and your storage
An API gateway in front of your services: keys, per-route rate limits, trusted-proxy handling and branded error pages
All of it self-hosted, so there is no per-seat bill that grows with your team and no third party holding your operational data
Deployed by the same automation we use on our own fleet, where these have been running in production for months
Open to replacement: if you would rather run Healthchecks, Zammad or Kong, we deploy and operate those instead
Not on the list?
The list describes what we take on. If the thing you need is not here, write to us: you get an honest answer about whether we do it, and who to ask instead if we do not.