A coherent, end-to-end open-source stack for a small-to-mid-size office. “Coherent” means one identity domain, one OS family, one virtualization platform, one storage/collaboration hub, and single sign-on woven through every service — the open-source analogue of a Windows-Server + Active-Directory + Microsoft-365 estate.
Every component below is free/open-source software (OSI-approved license) and self-hostable on hardware the office owns and controls.
License note — AGPL is treated as open-source here. “Community Edition” products are only included where their core is genuinely FOSS (not feature-gated freemium).
1. Design Principles
- One OS family. Debian (stable) everywhere — clients, servers, appliances. One package model, one update cadence, one set of sysadmin skills.
- One identity. FreeIPA is the directory of truth (LDAP + Kerberos + DNS + CA). All services authenticate against it; SSSD joins clients to the domain.
- One SSO plane. Keycloak (OIDC/SAML) sits in front of web apps, federated to FreeIPA. One login per person across mail, files, chat, conferencing, accounting, project boards.
- One collaboration hub. Nextcloud for files, calendars, contacts, and as the auth bridge to Collabora/OnlyOffice.
- One virtualization platform. Proxmox VE runs all VMs/LXCs; Proxmox Backup Server handles snapshots + dedup.
- Own the hardware, own the firmware. coreboot/Libreboot firmware on clients, OpenBMC on servers, OpenWrt on the network edge.
- No telemetry-leaking proprietary clients. Firefox/LibreWolf as the standard browser; no Chrome, no proprietary meeting clients.
- Everything backed up, everything reproducible. Infrastructure-as-code (Ansible) so the whole estate can be rebuilt from a Git repo.
2. High-Level Architecture
Core Infrastructure (Proxmox VE cluster)LDAP/KerberosHTTPS / KerberosOIDCOperationsPrometheus + GrafanaWazuh
SIEM / XDRProxmox Backup ServerBorgmatic offsiteProductivity & Business AppsMattermost / Matrix
chatJitsi Meet
video conferencingOpenProject
project / planningERPNext
accounting · CRM · inventoryKimai
time trackingZammad
helpdeskForgejo
git + CINetwork Edge (OpenWrt / OPNsense)Firewall + VPN
WireGuardUnbound + Pi-hole
DNSSEC / ad-blockKea DHCPWi-Fi APs
OpenWrtUsers & DevicesWorkstations
Debian + SSSDLaptops
Debian + corebootThin clients
LTSP PXE bootMobile
Nextcloud/DAVx5FreeIPA
LDAP + Kerberos + DNS + CAKeycloak
SSO / OIDC / SAMLNextcloud
files · cal · contactsCollabora / OnlyOffice
document co-editingPostfix + Dovecot
+ Rspamd + ClamAVRoundcube
webmail
3. The Stack, Layer by Layer
| Layer | Primary choice | Role | Alternatives |
|---|---|---|---|
| Firmware — clients | coreboot + SeaBIOS (Libreboot where supported) | Boot firmware with no proprietary blobs | U-Boot (RISC-V/ARM) |
| Firmware — servers | OpenBMC | Out-of-band server mgmt (IPMI replacement) | OpenBMC on vendor BMCs |
| Hardware | System76 / Framework laptops; OpenPower or standard x86 servers; RISC-V for niche appliances | Open / vendor-open hardware | Raspberry Pi, Raptor Talos |
| Network OS — router | OPNsense (free, hardened FreeBSD fork) | Firewall, routing, NAT, VPN concentrator | OpenWrt on x86, VyOS |
| Network OS — switches/APs | OpenWrt | Managed switches and Wi-Fi APs | OpenSwitch |
| VPN | WireGuard | Site-to-site + remote access | OpenVPN, Tailscale/Headscale (OSS control plane) |
| DNS | Unbound (recursive, DNSSEC) + Pi-hole (local ad/block) + FreeIPA DNS (internal zones) | Resolution + filtering + internal naming | CoreDNS, Knot Resolver, AdGuard Home |
| DHCP | Kea DHCP | Authoritative DHCP / DHCPv6 | dnsmasq |
| Client OS | Debian (stable), GNOME or KDE desktop | Standard workstation/laptop OS | Rocky/Alma, Fedora, Ubuntu LTS |
| Client join | SSSD + FreeIPA client | Domain join, Kerberos login, sudo/HBAC rules | realmd |
| Thin clients | LTSP (PXE/NFS root) | Diskless Debian boot from network | — |
| Directory / identity | FreeIPA | LDAP + MIT Kerberos + integrated DNS + CA — the “Active Directory for Linux” | 389 DS, OpenLDAP + Kerberos (manual) |
| SSO / web auth | Keycloak | OIDC / SAML IdP, federated to FreeIPA; SSO for every web app | Authentik, LemonLDAP::NG |
| Virtualization | Proxmox VE (KVM + LXC) | All workloads as VMs/LXC containers | oVirt, libvirt+virt-manager |
| Container runtime | Podman + LXC | App-level containers where appropriate | Docker, Kubernetes (k3s) |
| Reverse proxy / TLS | Traefik or Nginx + Certbot (internal step-ca or FreeIPA CA) | TLS termination, routing, ACME certs | HAProxy, Caddy |
| Mail — MTA/MDA | Postfix + Dovecot | SMTP, IMAP/POP3, sieve | — |
| Mail — anti-spam/anti-virus | Rspamd + ClamAV | Spam scoring, DKIM/DMARC/SPF, AV | SpamAssassin, Amavis |
| Mail — webmail | Roundcube (or SnappyMail) | Browser mail access | — |
| Mail — lists | Mailman 3 | Mailing lists | Sympa |
| Calendar/contacts | Nextcloud (CalDAV/CardDAV) + optionally Radicale | Shared calendars/address books | Baïkal |
| Files / sync | Nextcloud | File sync, share, WebDAV, sharing links | Seafile, ownCloud |
| Office suite (desktop) | LibreOffice | Document authoring | Calligra |
| Office suite (collab web) | Collabora Online (or OnlyOffice Docs Community, AGPL) | Real-time co-editing of ODF/OOXML in browser | — |
| Document scanning/OCR | Paperless-ngx | Scan, OCR, archive, full-text search | — |
| Chat | Mattermost (Slack-like) or Matrix (Synapse + Element) | Team messaging | Rocket.Chat |
| Audio/voice | Jitsi Meet’s jigasi bridge, or Mumble | Voice channels | — |
| Video conferencing | Jitsi Meet (self-hosted, no client install for browser/SIP) | Meetings, webinars, screen share | BigBlueButton (e-learning heavy) |
| Project / PM | OpenProject | Project planning, Gantt, time, bug tracking | Taiga, Redmine, Leantime |
| Kanban | Wekan | Lightweight boards | Focalboard |
| Accounting / ERP | ERPNext (Frappe framework, GPLv3) | Books, invoicing, payroll hooks, CRM, inventory, manufacturing | Odoo Community (watch AGPL/OOL modules), GnuCash (desktop-only), Ledger CLI |
| Invoicing (light) | Invoice Ninja (self-hosted) | Standalone invoicing if ERPNext is overkill | — |
| Time tracking | Kimai | Timesheets, billing export | — |
| HR | OrangeHRM | Staff records, leave | — |
| Helpdesk / ITSM | Zammad | Ticketing, knowledge base | osTicket, Request Tracker |
| Version control / CI | Forgejo (+ Forgejo Actions) or Gitea | Git hosting, code review, CI | GitLab CE (heavier) |
| Wiki / knowledge base | BookStack or MediaWiki | Internal docs | DokuWiki |
| Database | PostgreSQL (primary), Redis, MariaDB (where an app needs it) | App data stores | — |
| Object storage | MinIO (S3-compatible) | App-level object storage, Nextcloud S3 backend | — |
| Monitoring — metrics | Prometheus + Grafana + Alertmanager | Time-series, dashboards | Zabbix |
| Monitoring — network | LibreNMS | SNMP device inventory & uplink graphs | Zabbix |
| Monitoring — uptime | Uptime Kuma | Synthetic checks / status page | — |
| Logging / SIEM | Wazuh | Log aggregation, HIDS, XDR, compliance | Elastic Stack (Free tier), Graylog |
| Backups — VM | Proxmox Backup Server | Dedup, incremental, encrypted VM/LXC backups | — |
| Backups — file/app | Borgmatic (BorgBackup) / Restic | App + file backups to offsite target | Bareos, UrBackup |
| Security hardening | OpenSCAP, fail2ban, AIDE, certbot/step-ca | Compliance scans, intrusion detection | — |
| Browser | Firefox ESR (or LibreWolf) | Standard, privacy-respecting browser | — |
| Printing / scanning | CUPS + SANE | Print & scan spooling | — |
| File sharing (legacy) | Samba | SMB shares for any Windows-guest or scanner needs | NFS (internal) |
| Configuration mgmt | Ansible (+ Forgejo repo) | Declarative infra, reproducible rebuilds | Salt, Puppet |
| Remote access / support | RustDesk (self-hosted) or MeshCentral | Remote desktop / support sessions | — |
| DNS records automation | lexicon / FreeIPA DNS API + Ansible | Keep DNS in sync with deployments | — |
4. How Coherence Works (the “glue”)
The estate is coherent because five things are shared across every service:
4.1 Identity — FreeIPA is the source of truth
- Every person and service is a FreeIPA principal (Kerberos) and LDAP entry.
- HBAC (Host-Based Access Control) rules decide who can SSH into which hosts; sudo rules are centrally managed.
- FreeIPA runs the internal DNS (zone
office.local) and an internal CA so every service gets a real TLS certificate — no self-signed warnings, no browser exceptions.
4.2 Single Sign-On — Keycloak
- Keycloak federates to FreeIPA (LDAP user federation + Kerberos).
- Each web app (Nextcloud, Jitsi, Mattermost, OpenProject, ERPNext, Zammad, BookStack, Roundcube, Paperless, Grafana) is registered as an OIDC or SAML client.
- A user logs in once per day; everything else is seamless. Joining a new app = registering one OIDC client in Keycloak + pointing the app at it.
4.3 Storage — Nextcloud as the hub
- Home directories for “personal cloud” files; group folders for departments.
- Calendars (CalDAV) and contacts (CardDAV) live in Nextcloud and sync to mobile via DAVx⁵.
- Nextcloud mounts the Samba-backed scanner drop folder so Paperless-ngx ingests scans automatically.
- Nextcloud integrates Collabora/OnlyOffice for in-browser document editing with the same SSO identity.
4.4 Mail tied to identity
- Postfix uses FreeIPA LDAP for recipient validation; Dovecot authenticates IMAP against Kerberos/LDAP.
- Mailing lists (Mailman) and shared mailboxes (Dovecot’s
acl) reuse the same directory groups, so “finance@”, “sales@”, etc. are just FreeIPA group memberships.
4.5 Observability & secrets shared
- Prometheus scrapes every exporter via the same TLS CA; Grafana authenticates via Keycloak OIDC.
- Secrets (DB passwords, API keys) are stored in Vaultwarden (self-hosted Bitwarden) or FreeIPA’s password vault, never sprinkled in Ansible vars.
5. Deployment Topology (example: 3-node office)
| # | Host (VM/LXC on Proxmox) | Roles | Notes |
|---|---|---|---|
| 1 | ipa1 | FreeIPA, internal DNS, CA | Replicas: ipa2 |
| 2 | keycloak1 | Keycloak SSO | Behind reverse proxy |
| 3 | mail1 | Postfix, Dovecot, Rspamd, ClamAV, Roundcube | DMARC/DKIM via Rspamd |
| 4 | nextcloud1 | Nextcloud + Collabora + MinIO (S3 primary storage) | Postgres on db1 |
| 5 | chat1 | Mattermost (or Synapse) | OIDC to Keycloak |
| 6 | jitsi1 | Jitsi Videobridge + Jicofo + Prosody | Behind reverse proxy |
| 7 | erp1 | ERPNext + MariaDB | OIDC to Keycloak |
| 8 | pm1 | OpenProject | OIDC to Keycloak |
| 9 | help1 | Zammad + Elasticsearch | OIDC to Keycloak |
| 10 | git1 | Forgejo + Forgejo Actions runners | OIDC to Keycloak |
| 11 | obs1 | Prometheus, Grafana, Alertmanager, Uptime Kuma | OIDC to Keycloak |
| 12 | sec1 | Wazuh manager + indexer + dashboard | — |
| 13 | db1 | PostgreSQL (for Nextcloud, Keycloak, Zammad, OpenProject) | Point-in-time recovery |
| 14 | pbs1 | Proxmox Backup Server (physical or dedicated) | Offsite sync with Borgmatic |
| 15 | edge1 | OPNsense + WireGuard (physical, dual-WAN) | — |
| 16 | sw1..n, ap1..n | OpenWrt switches & Wi-Fi APs (physical) | — |
The three Proxmox nodes form a Ceph or ZFS-over-replication cluster with live migration; losing one node moves workloads automatically. pbs1 holds encrypted, deduplicated backups; an offsite Borgmatic target holds a second copy.
6. Security & Compliance Posture
- TLS everywhere, internal CA (FreeIPA / step-ca); Certbot/ACME for public-facing names. No plaintext protocols on the LAN.
- WireGuard for all remote access; no exposed RDP/SSH to the internet.
- SELinux/AppArmor enforcing on servers; OpenSCAP profiles applied (Debian CIS baseline).
- fail2ban + Wazuh for brute-force detection and host-based detection; logs ship to Wazuh indexer.
- AIDE file-integrity monitoring on
ipa1,db1,mail1. - DNS filtering via Pi-hole; DNSSEC validation via Unbound.
- Least privilege via HBAC — developers can’t reach finance DBs, finance can’t reach git runners, all enforced centrally in FreeIPA.
- Backups follow 3-2-1: PBS (on-site, deduped), Borgmatic offsite, nextcloud files also snapshotted to MinIO.
7. Adoption & Migration Path
- Stand up the spine first — Proxmox cluster → FreeIPA → Keycloak → reverse proxy + TLS. Nothing else is built until SSO works.
- Migrate identity — create users/groups in FreeIPA matching existing roles; join a pilot Debian workstation via
realm join. - Email — cut over Postfix/Dovecot, migrate mailboxes with
imapsync, configure DKIM/DMARC. - Files & office — deploy Nextcloud + Collabora; migrate shared drives into group folders; install LibreOffice on clients.
- Collaboration — Mattermost/Matrix + Jitsi; switch the office off proprietary meeting clients.
- Business apps — ERPNext for accounting/invoicing; OpenProject for delivery; Kimai for time; Zammad for IT requests.
- Observability & backup — Prometheus/Grafana/Wazuh last, once there’s something to watch; PBS from day one.
- Automate everything — the entire build is captured in an Ansible playbook in Forgejo, so the estate is reproducible and rebuildable in hours, not weeks.
8. Where Proprietary Stays Out (intentional)
| Avoided | Open replacement |
|---|---|
| Windows Server / Active Directory | FreeIPA |
| Exchange / Outlook | Postfix+Dovecot+Roundcube, Nextcloud for calendar |
| Microsoft 365 / SharePoint | Nextcloud + Collabora |
| Teams / Zoom | Jitsi Meet + Mattermost/Matrix |
| Slack | Mattermost |
| QuickBooks / Xero | ERPNext (or GnuCash for simple bookkeeping) |
| Jira | OpenProject |
| GitHub (cloud) | Forgejo (self-hosted) |
| Zoom/Webex client install | Jitsi (browser-only) |
| Chrome / Edge | Firefox ESR / LibreWolf |
| Dropbox / Google Drive | Nextcloud |
| LastPass / 1Password (cloud) | Vaultwarden (self-hosted Bitwarden) |
9. Total Licensing
Every component above ships under an OSI-approved license (GPL, AGPL, LGPL, MPL, Apache-2.0, or BSD). The whole estate can be operated with zero per-seat licensing fees, auditable end-to-end, and rebuildable from a single Git repository. That is the definition of “completely open source.”
Leave a Reply