Solution
Private servers and private cloud
Some constraints justify compute or storage on site. The decision covers capital, refresh, energy, patching, privileged administration, monitoring, off-site backup, capacity and the people to run it, not just owning the hardware.
Your walls, your machines, your access
Sensitive flows become explicit
Data gets classified by use and constraint. On site does not mean no data leaves: support, telemetry, backup, administration and outbound dependencies stay under control.
Remote access follows identity, not a tunnel
Every selected access path is authenticated, limited to the systems the role requires and logged. Environments stay separated, without promising that a compromised account can reach no other system.
File sharing becomes usable again
A link that expires, readable permissions, and a sync that holds on large folders. That’s what keeps the team from going back to a consumer service.
Rebuilding becomes testable
Controlled code and artefacts enable a rebuild compared against criteria. Data, secrets, dependencies and operating steps remain separately rehearsed.
In practice
- Virtualisation on your own hardware, sized on measured use
- Internal file sharing with expiring links and permissions taken from the directory
- Remote access by identity, limited to the named systems and logged
- Separated environments: production, test and backup exchange only where the plan says so
- Infrastructure described in versioned code, reviewed before it is applied
- Off-site backup and a rehearsed restore of the hardware installed with you
Systems involved
- Proxmox, KVM and the hypervisors already in place
- Nextcloud and file servers
- The corporate directory, for identity and permissions
- Infrastructure as code and configuration management, such as Terraform and Ansible, where the scope supports them
- A Swiss host, for the off-site backup copy
Service lineServers and hosting →
Which uses
The same work, against each sector’s own constraints. Every card opens the full sector.
Energy and utilities
Compute and storage near the sites
Whatever has to stay reachable when the link drops runs locally, with off-site backup and rebuilding described in code.
Healthcare and life sciences
On-premise compute for data that can’t travel
Where the constraints justify it, compute, storage and access remain on site with outbound flows, support, backup, administration and telemetry explicitly controlled.
Manufacturing
Shop-floor network segmentation
Production, office and technical equipment separated, with what must talk to what and nothing else.
How it runs
Splitting the workloads
What stays with you, what goes elsewhere, and why. The answer is rarely all one or all the other.
Foundation
Hardware, hypervisor, storage and environment separation, described in code from the first machine.
Services
File sharing, remote access and internal applications installed on that foundation, one service at a time.
Safety net
Off-site backup, a timed restore, and the written procedure for the day the room is unreachable.
Test the fit: Private servers and private cloud
Describe the context, constraints and decision you need to make. The first conversation qualifies scope, boundaries and the next useful step.
Describe the situation