/solutions/internal-tools

The tools your team runs on — without an ops team.

Install n8n, Metabase, NocoDB, Directus or any of the other ready-made apps on a server of your own. They share one database instead of four, back up into your own bucket, and sit behind your organization’s sign-in rules.

Request early access Talk to us

23 ready-made apps
One shared database
Backups on a plan

Ready-made39Docker HubliveMCP serversregistry

n8nAutomation · app + PostgresInstall
GrafanaMonitoringInstall
WordPressContent · app + MariaDBInstall

postgres

postgresDocker Official ImageInstall
pgvector/pgvectorPostgres with vector searchInstall

README read: POSTGRES_PASSWORD is required

GitHubissues, pull requests, codeInstall
Filesystemread and write filesInstall
Fetchweb content for agentsInstall

/the-path

From “we need a tool” to a tool that is backed up.

Each step links to the page that explains it.

01
One server for the tools
A Standard size is usually plenty to start; grow its CPU and memory later without touching the disk.
Servers
02
Pick from the Marketplace
n8n, Metabase, NocoDB, Baserow, Uptime Kuma, Wiki.js and more — each page says every container, port and variable it will create before you install.
Marketplace
03
One database for all of them
When a recipe needs PostgreSQL and you already run one, point it there. The app joins that database’s network; removing the app later leaves the database alone.
Databases
04
Backups on a plan
Dumps every few hours into your own bucket, a copy of the tools’ folders weekly — as many plans as you like, each keeping what you say.
Databases
05
Who may do what
Invite the team with roles; require two-factor or single sign-on for everyone. Every change is in the audit log.
Security
06
Talk to the tools
A tool that publishes an MCP server or an OpenAPI document becomes a system: its actions listed, tried and recorded — and the assistant can use them.
Systems & MCP

/what-changes

Run tools like an ops team would.

Nothing installed without a look first.

An install is two steps: where it goes and the few answers it needs, then the review of every container it will make — images, ports and who reaches them, variables and where their values come from. A password it needs is generated as a real secret.

The exact commands, secrets by name, before anything runs.
If any part fails, what was made is removed.
The listing’s own warning — “create the owner account now” — shown once, when it matters.

Review what will run on @vm-prod-1

Replaced by stopping first — it keeps data. Port 3306 stays inside ts-default.

1Make the network ts-default — if it is not on the server yetdocker network create ts-default
2Download mariadb:11.8docker pull mariadb:11.8
3Create and start itdocker run -d --name mariadb --network ts-default \ --restart unless-stopped \ -e 'MARIADB_PASSWORD=<generated, kept as the secret DB_PASSWORD>' \ -v 'ts-mariadb-data:/var/lib/mysql' mariadb:11.8
4Wait until its health check passes

I have checked what will run on vm-prod-1Create

Kept safe, without anyone remembering to.

Backups run on their plan and land in your bucket; a failed one tells the people who can fix it. A crashed container is noticed within two minutes. Security updates install themselves on the server.

Crashes, failed backups and failed deploys become notifications.
Servers take keys only for SSH and admit only SSH, HTTP and HTTPS.
Restore always takes a copy of what is there first.

acme-backupsprivate

backups/crm-mysql/

2026-09-25 06:0018.4 MB
2026-09-25 00:0018.3 MB
2026-09-24 18:0018.1 MB
2026-09-24 12:0018.1 MB

Restore takes a copy of what is there first

/trust

Nothing irreversible without you.

Safety here is a set of mechanisms you can inspect, not a badge: what the platform will not do on its own, and what it writes down when it does.

How we keep it safe

An isolated cloud per organization
Servers, networks, databases, buckets and secrets belong to one organization. Nothing is shared with anyone else.
Destructive means typed back
A tool that changes data asks first; one that destroys it asks for its name typed back. Every call lands in a ledger.
Secrets never on a command line
Encrypted and versioned, handed to a container only at deploy time — over stdin, never in a command or a log line.
See it before it runs
Every create shows the exact Docker commands it will run, with secrets by name, before anything is made.
Deploys that can’t take you down
The new container must pass its health check before the old one goes. If it fails, the old one is still serving.
Sign-in you control
Passkeys, two-factor, single sign-on with OIDC or SAML 2.0, verified email domains — and you can require them.

/start

Your tools, running tonight.

Request early access. Every listing is free — pay for the server they share.

Request early access Talk to us

The tools your team runs on — without an ops team.

One server for the tools

Pick from the Marketplace

One database for all of them

Backups on a plan

Who may do what

Talk to the tools

Nothing installed without a look first.

Kept safe, without anyone remembering to.

An isolated cloud per organization

Destructive means typed back

Secrets never on a command line

See it before it runs

Deploys that can’t take you down

Sign-in you control

Your tools, running tonight.