Self-Hosted Business Stack
The full internal stack a small company needs, self-hosted on infrastructure we control, with one sign-on across all of it and no data leaving the country.
Every small company assembles the same stack: identity, files, chat, a git host, an ERP, a password vault, monitoring. The usual route is a monthly subscription for each, which is fast, and which puts the company’s records on someone else’s infrastructure in someone else’s jurisdiction. In Quebec that is not a matter of taste. Law 25 makes data residency a legal requirement.
So this is that stack, self-hosted, on infrastructure we control. Eleven services behind one sign-on: identity and MFA in front of everything, a mesh VPN so nothing but the reverse proxy is exposed to the internet, a reverse proxy with automatic TLS, a git forge with issues and code search, ERP and CRM, team chat, a password vault, document management with OCR, SIEM and endpoint monitoring, isolated browser workspaces, and a managed Postgres behind the services that need one.
What we measured
Nine run as Docker Compose services and two are installed natively, each with a written reason for which way it went. Every service binds to localhost and is reachable from outside only through the reverse proxy. What makes this repeatable rather than an anecdote is the deployment order, fixed because each layer depends on the one before it, and a per-service size in vCPU, RAM and disk, so the hosting bill is known before anything is provisioned.
Why it holds
The ERP is the part most people underestimate. Standing it up is an afternoon. Making it usable is a ten-step configuration done in a fixed order: company setup, a Canadian chart of accounts with Quebec additions, tax templates for GST and QST, currencies and exchange rates, territory rules so the right tax is selected automatically, the service catalogue, CRM pipeline stages, a restricted role so external contractors cannot see client records, user role mapping, and invoice numbering. Skip the order and you get an ERP you tear down and redo.
Useful if you are replacing a stack of monthly subscriptions, moving off a hosting provider, meeting a residency requirement, or simply sizing what you would need before committing to any of it.
SCOPE AND LIMITS
This describes what the installer and the runbook deploy, and what runs on our own estate. It is not a claim that all eleven services are running in one place for any given client. The deployment order and the per-service sizing are the deliverable; what actually gets stood up depends on what is needed.
STACK
- Docker Compose
- Nginx
- Authentik
- Forgejo
- ERPNext
- Mattermost