Self-hosted apps¶
The lab runs a complete self-hosted replacement for the SaaS stack — the same services a small company would pay for monthly, operated on own hardware behind one SSO.
The catalog¶
| App | Replaces | Purpose |
|---|---|---|
| Matrix (Synapse) + Element | Slack / Discord | Team and tenant chat, agent surfaces, bridges |
| Vikunja | Todoist / Asana | Tasks and projects, per-tenant access |
| Firefly III | Personal finance SaaS | Budgeting and money tracking |
| wger | Fitness apps | Workout and health tracking |
| Plane | Linear / Jira | Issue tracking and project management (business backlog) |
| Langfuse | LLM observability SaaS | LLM tracing, spend, and evaluation |
| SearXNG | Google search API | Private, free metasearch — the first rung of the search ladder |
| Crawl4AI | Scraping APIs | Self-hosted page-to-markdown scraping — the first rung of the scrape ladder |
| Self-hosted browser service | Cloud browser tools | Persistent human-watchable browser for logins/captcha/payments |
| Beszel + Uptime Kuma | Datadog-lite / pingdom | Lightweight server and uptime monitoring |
| Mission control | Ops dashboards | Unified panel for gateways, tasks, and broadcasts |
| Caddy | Nginx/Traefik | Reverse proxy, automatic TLS, SSO auth gates |
| Infisical | Vault / Doppler | Secrets management (see Infisical) |
| Authentik | Okta / Auth0 | Identity provider (see Authentik) |
| Git + GitHub Actions | CI/CD SaaS | Pipelines, PRs, deployment automation |
| LiteLLM | OpenAI gateway / Azure AI | Model gateway (see LLM gateway) |
The "replace SaaS" thesis¶
Every app here exists because a SaaS product was doing the same job for a monthly fee — while holding the data. The platform's operating thesis is that a small team with Kubernetes, one managed database, and good automation can run the whole suite for a fraction of the cost, with the data on servers they control.
Shared services they all use¶
- One SSO — Authentik, with the fluid-login rule (see Authentik).
- One database strategy — a single managed PostgreSQL instance with one logical database per app: centralized backups, point-in-time recovery, no per-app database babysitting.
- One ingress — Caddy with automatic TLS, auth gates, and the public entry points.
- One backup pipeline — scheduled dumps to S3 with restore drills; the self-hosted tier backs up offsite so even the hardware can fail.
- One observability stack — health checks, uptime monitoring, LLM tracing (Langfuse), and a mission-control panel.
Cost discipline¶
The self-hosted first rungs are not decoration: SearXNG and Crawl4AI are the free rungs of the paid provider ladders in the broker, which measurably cuts search/scrape spend — a recurring example of the lab's "self-host before you pay" default.