otstech.ca // private infrastructure

One true stack.

A private cloud, network and identity platform, designed and run end to end. Every service on it lives on hardware I can walk over to and put a hand on — which is most of the point.

It exists because a four-bay NAS full of failing drives took everything, once. The rebuild is the product.

Read how it started Get in touch

Posture controls in place

StorageZFS · scrubbed · snapshotted

Backup3 tiers · one kept offline

Identityone directory · SSO + MFA

Network8 zones · deny by default

Accesskey-only · no fleet passwords

Loggingcentralised · alerts to phone

A summary of controls, not a live status board.
Real-time health is published to the people who hold accounts.

2HypervisorsVMs, containers, GPU passthrough

8Network zonesfirewalled from one another

38Published servicesreverse-proxied, TLS throughout

3Backup tierssnapshot · replica · offline

20Hosts, key-onlypassword login removed fleet-wide

5UPS unitsevery rack monitored on battery

01 — Origin

All of this is downstream of one bad week.

The order below is the order it actually happened in. None of it was designed up front — each layer got added the day the one underneath proved it couldn't be trusted on its own.

00The failure

Four consumer drives in a four-bay NAS. No checksums, no scrubs, nothing but the one copy. The box told me it was healthy right up until two disks failed inside the same week, and everything on it went with them — including the photos, which is the part I still think about.

The lesson wasn't buy better drives. It was that it's backed up and it has been restored are two different sentences, and I had only ever said the first one.

01The floor

Everything since sits on storage that can prove itself. ZFS, so silent corruption gets caught on a scrub instead of quietly copied forward into every backup I own. Snapshots on a schedule, so a mistake costs five minutes instead of an evening.

Then a replica on a second machine in another room, and an encrypted copy that lives offline — unplugged, out of reach of anything that can route to it. Three tiers, because two is one and one is none.

02The sprawl

Storage you can trust turns out to be what everything else was waiting on. Files and calendars came off rented cloud first. Then the photo library, with faces and search that never leave the building. Then media, then the cameras, then the house, then the phones.

None of that was ambition. Each one moved in because the floor could finally hold it.

03The discipline

Thirty-odd services is a different problem from one. Accounts went behind a single directory with one sign-on and multi-factor in front of it. The network got carved into zones that can't reach each other by default, and the management segment got no route to the internet at all. Logs went to one place. Password logins came off the fleet entirely.

Every one of those controls has a date on it, and every date is the day something proved it was missing. I'd love to claim I planned it that way.

04The name

One True Stack started as a joke about the sprawl and hardened into the rule that governs it. One identity provider, not six. One backup policy, applied to everything — including the things nobody would miss. One repository that every deployment comes from, with the estate in version control and a changelog per application.

If a thing exists twice, one of them is wrong. That's the whole philosophy, and it's why there hasn't been a second bad week.

— Zach, One True Stack Technologies

02 — Architecture

Read it from the bottom.

Every layer here only works because the one beneath it does. That isn't a drawing convention — it's the lesson from 00, made literal. Storage is where the whole thing is load-bearing, which is why it's the layer with three independent copies and the only one tested on a schedule.

The dashed line is the trust boundary. Nothing below it is reachable from the internet directly; public traffic terminates at the edge and is proxied inward, one service and one hostname at a time.

07
              Edge
              Dual WAN, zone-based firewall policy, TLS termination and per-service publishing
            

            Public
            
            Private
          
06
              Services
              Files, photos, media, cameras, home automation, voice, line-of-business apps
            
05
              Identity
              One directory, single sign-on with MFA, RADIUS and TACACS+ for network gear
            
04
              Observability
              Centralised syslog, uptime checks, power and thermal telemetry off the BMCs
            
03
              Virtualisation
              Two hypervisor nodes running VMs and containers, GPU passthrough where it earns it
            
02
              Storage & protection
              ZFS pool, scrubbed and snapshotted, replicated to a second machine, copied offline
            
01
              Hardware & power
              Enterprise routing, switching and wireless; battery backup and monitoring on every rack
            

03 — Capabilities

What the stack actually does.

Eight disciplines, all of them in production against real users and real data. Hostnames aren't published here on purpose.

Storage & backup

Checksummed pools with scheduled scrubs and snapshots, replicated to a second machine and copied to encrypted media kept offline. Restores are performed, not assumed.

ZFSsnapshotsreplicationoffline copy

Private cloud

Files, calendars, contacts and collaborative document editing, alongside a photo library with search, faces and places computed on premises. Nothing is indexed by a third party.

filescalendarphotosdocuments

Identity & access

A single directory as the source of truth, single sign-on with multi-factor in front of every application, and RADIUS and TACACS+ so network gear authenticates against the same accounts.

LDAPOIDCMFATACACS+

Network

Carrier-grade edge routing with dual upstream, zone-based firewall policy between every segment, and enterprise wireless under a controller with per-SSID segregation.

dual WANZBFWVLAN designcontroller Wi-Fi

Monitoring

Centralised syslog with retention, uptime checks against every published service, and hardware, power and thermal telemetry pulled straight off the server management controllers.

sysloguptimeBMC telemetryalerting

Virtualisation

Two hypervisor nodes carrying virtual machines and containers, with GPU passthrough for hardware transcoding and on-premises machine learning workloads.

KVMLXCGPU passthrough

Physical & power

Cameras that record locally and never call home, battery backup with monitoring on every rack, plus environmental, door and alarm sensing wired into the automation platform.

local NVRUPSsensorsalarm bridge

Applications

Custom line-of-business web software built to order — scheduling, billing, network configuration tooling — shipped through the same tagged pipeline and identity layer as everything else.

PythonTypeScriptPostgresDocker

04 — How it runs

Five rules that keep it maintainable by someone who isn't me.

Everything is in version control. Configuration, deployment scripts, application source. A release is a tagged commit and a rebuild — not a person remembering what they touched last Tuesday.

Restores are tested. A backup nobody has restored from is a rumour. Three independent tiers, one of them physically offline, and the restore path gets exercised rather than diagrammed.

Segmented by default. Zones can't reach each other unless a rule says so, and the management network has no route to the internet at all. Convenience holes get argued about before they get punched.

Written down while it's built. Every application carries a changelog and a runbook, and the reasoning sits in the repository beside the code — including the wrong turns, which are usually the expensive part to rediscover.

Audited, not assumed. The estate has been through a formal security review covering perimeter, storage, identity, applications and backup. Findings were ranked and closed, not filed.

05 — Working together

Three ways this tends to be useful.

Design & build

Storage, network, identity and virtualisation specified against what you actually run — sized for the real workload rather than a vendor's reference diagram.

Move off rented cloud

Files, photos, backup and collaboration brought in-house without losing the parts people liked. Migrations planned so the old thing keeps working until the new one is proven.

Keep it running

Monitoring, patching, backup verification and change control — plus someone who picks up when it breaks at an inconvenient hour, which is the only hour it breaks.

Not selling packages yet.

Happy to talk about what you're running, what's fragile about it, and whether any of the above is worth doing. No pitch deck.

[email protected]