- Server: Kubernetes (Rancher)
- IAM/MFA: Authentik
- Directory: Samba AD + Zimbra CE
- Client: Ubuntu LTS and Derivatives
This project presents a fully on-premise, Ubuntu LTS-based open-source enterprise architecture designed to reduce cloud dependence and strengthen data sovereignty. Server-side services run as containers on Kubernetes managed by Rancher; identity and MFA are provided by Authentik; directory and mail services are implemented with Samba 4 Active Directory and Zimbra Community Edition. Security and observability layers rely on Wazuh (SIEM) and Prometheus + Grafana (metrics and alerting). The network perimeter is protected by physical firewalls, and backups are handled by physical appliances (e.g., QNAP NAS). The initiative aims to produce comparative evidence—against Microsoft’s cloud-first ecosystem—across TCO, security, usability, and portability, with a primary legal focus on data residency and sovereignty.
Cloud-first mandates and the U.S. CLOUD Act create extraterritorial exposure even when data is hosted in-region. The vision is an on-prem, open-source stack where compute, identity, keys, and backups remain under the organization’s legal and operational control, avoiding vendor-operated control planes. See Background Analysis for legal/strategic context.
Accelerated digitalization in the public and private sectors has made cloud computing platforms attractive; however, it has also brought critical issues such as data sovereignty, privacy, and Total Cost of Ownership (TCO) to the forefront. Regulations like the US CLOUD Act increase the risk of data being subject to foreign legal demands. Specifically within the Microsoft ecosystem, steps such as the Azure-centric evolution of Windows Server 2019–2025 and the deprecation of WSUS are driving organizations towards hybrid/cloud solutions. This project evaluates an open-source, on-premise architecture against these risks using technical and managerial metrics.
See Background Analysis for details.
Purpose: Design a manageable, reproducible Ubuntu-based open-source enterprise architecture that reduces dependence on cloud providers and strengthens data sovereignty; benchmark against the Microsoft ecosystem.
Research Questions:
1) TCO advantage vs proprietary licensing
2) Security/Compliance (SSO/MFA/SIEM/Vuln)
3) Usability & Manageability (Rancher/K8s experience)
4) Data Sovereignty (reducing CLOUD Act exposure)
| Service Area | Component | Key Features |
|---|---|---|
| OS | Ubuntu LTS (Server) + Mint/Zorin (Client) | LTS stability, broad ecosystem, user-friendly desktop. |
| Cluster Mgmt | Kubernetes + Rancher | Multi-cluster GUI, RBAC, catalog, upgrade workflows. |
| Directory | Samba 4 Active Directory | AD-compatible LDAP/Kerberos; Windows/Linux clients. |
| IAM / SSO | Authentik | SAML/OIDC/LDAP/RADIUS; MFA (TOTP/WebAuthn); policy engine. |
| Email/Collab | Zimbra CE | External auth with AD; web client; calendar/contacts; on-prem storage. |
| SIEM/XDR | Wazuh | Centralized logging, correlation, compliance reports. |
| Observability | Prometheus + Grafana | Metric collection, dashboards, alerting. |
| Storage | Longhorn (CSI) | Distributed block storage with snapshots. |
| Load Balancing | MetalLB (L2) | Service IPs on bare-metal via ARP/NDP. |
| PKI | Cert-Manager | Automated internal certificates. |
| Backup | Velero + MinIO (S3) | Cluster + PVC backups with CSI/kopia. |
| IaC | Ansible | Infrastructure as Code; reproducible & portable setups. |
The project follows a strict DevOps and PM framework to ensure reproducibility and timely delivery.
Persona-based desktop catalog: Ubuntu Desktop (baseline), Linux Mint/Zorin (Windows converts), Pop!_OS (engineers), Kubuntu (power users), Xubuntu/Lubuntu (legacy/thin), Ubuntu MATE (traditional), elementary OS (kiosk/public), KDE Neon (R&D). See Client Strategy for details.