Sovereign Comms Appliance
This document outlines the baseline logical and physical architecture for the Dedicated Bare Metal edition of the Sovereign Comms Appliance. It details the container deployment fabric, hardware-enforced cryptography boundaries, and network ingress rules governing a single-tenant, bare-metal Docker environment.
Scope of Architecture: Dedicated Bare Metal vs. Cloud/VPS
While our Cloud/VPS tier relies on a virtualized host operating system provided by a third-party cloud provider, the Dedicated Bare Metal tier assumes exclusive, physical control over the underlying hardware. This allows for the integration of hardware-level defense-in-depth protections while utilizing the same efficient, containerized deployment fabric (Docker) for logical application segmentation.
Target Audience & Strategic Positioning
The Dedicated Bare Metal Tier is our recommended architecture for the majority of mid-sized organizations, growing enterprises, and privacy-conscious collectives that have outgrown shared cloud/VPS infrastructure. It hits the “sweet spot” across three key domains:
- Performance vs. Value: By running a single unified OS (Debian) directly on bare metal, 100% of the CPU and I/O capacity is dedicated strictly to the containerized workloads. There is zero hypervisor overhead and no need to over-provision hardware just to run multiple virtual machine operating systems.
- Security Posture: It retains the identical, high-grade physical defenses of an enterprise datacenter (SME/TME Memory Encryption, IOMMU DMA controls, and full-disk LUKS2 encryption) to defend against physical server seizures.
- Simplicity of Administration: Unlike managing a Proxmox cluster with nested VMs and complex virtual networking, administration is simplified to standard Linux server maintenance and a single, unified
docker composelifecycle.
When to Upgrade to the Dedicated Hypervisor Tier
While the Bare Metal Docker tier is the most efficient choice for most, organizations should consider stepping up to the Dedicated Hypervisor Tier if their threat model or compliance framework strictly requires:
- Strict Blast-Radius Isolation: Running distinct Virtual Machines prevents kernel-level escapes; a compromise in the edge proxy VM cannot physically access the memory space of the database VM.
- Distinct OS Requirements: The need to run isolated, specialized operating systems (e.g., separating an immutable Alpine proxy appliance from a Debian database server).
- Complex Resource Fencing: The ability to strictly limit memory and CPU cycles using a hypervisor’s hard resource boundaries, mathematically preventing a runaway process in one stack from starving another.
Physical Hardware & Advanced Threat Mitigation
A highly sophisticated physical attack involves a “live seizure” or “hot extraction,” where an attacker uses a mobile uninterruptible power supply (UPS) cart to physically remove a server from a datacenter rack while keeping it powered on. This attempts to bypass standard “power-off” disk encryption. This tier defends against this via:
- Transparent Memory Encryption (SME/TME): Physical memory modules are encrypted in real-time. If an attacker attempts to logically dump, physically probe, or freeze the RAM on the live machine, the memory contents remain unintelligible ciphertext.
- Hardware IOMMU Controls: Direct Memory Access (DMA) attacks are neutralized. An attacker cannot plug in a malicious peripheral (such as a compromised PCIe network card or a rogue Thunderbolt device) to scrape live memory over the hardware bus.
Host-Level Cryptographic Boundary
To ensure all data is secure at rest without suffering from the performance degradation of virtualized double-encryption, cryptography is strictly enforced at the bare-metal level.
- Host-Level LUKS2 Encryption: The underlying storage pools (NVMe SSDs and SATA/SAS HDDs) are encrypted using LUKS2 (
dm-crypt) directly on the bare metal host. Keys are managed at the host level, ensuring that if physical drives are removed from the chassis, all data remains cryptographically inaccessible.
Logical Component Segmentation
Just as in the Cloud/VPS tier, rather than deploying applications directly to the host OS, all workloads are segmented using isolated Docker containers. This limits the blast radius of potential exploits and streamlines system migrations.
Traefik Ingress & TLS Termination
This container functions as the primary perimeter defense and reverse proxy layer.
- Role: Ingress controller, Layer 7 routing, and TLS termination.
- Workload: Traefik Proxy.
- Resource Profile: Operates with minimal privileges, requiring low compute overhead as it purely handles network I/O and TLS offloading.
Core Communication & Identity Services
This is the high-performance compute group for synchronous real-time communication and identity workloads.
- Role: Unified communications, identity management, database indexing, and credential storage.
- Workloads: Matrix Homeserver (RocksDB/Postgres), Stalwart Mail Engine (Raw Mail Directory & RocksDB), Vaultwarden, LiveKit SFU.
- Resource Profile: Heavy compute and high-IOPS storage allocation to handle the dense write paths, indexing structures, and message states inherent to concurrent mail and chat protocols.
Sovereign Storage
Designed for asynchronous data workloads, heavy database queries, and object storage management.
- Role: Private cloud storage, document sync, and relational databases.
- Workloads: Nextcloud Core, Office Suite, PostgreSQL, Redis (Memory/File Caching).
- Resource Profile: Heavy memory and storage allocation. Fast application databases and caches reside on SSDs, while raw user files are typically offloaded to high-capacity storage pools.
Architectural Topology
The final deployed state of the dedicated bare-metal tier consists of a single host operating system with all workloads cleanly isolated via the Docker container fabric.
========================================================================
PUBLIC INTERNET (WAN)
========================================================================
│ (Web: 80, 443)
│ (VPN Gateway: 51820 UDP)
│ (Stalwart Mail: 25 TCP - for inbound mail exchange)
│ (Conferencing: 3478 TCP/UDP, 7881 TCP, 7882 UDP, 60000-65000 UDP)
▼
┌──────────────────────────────────────────────────────────────────────┐
│ DEDICATED BARE METAL HARDWARE │
│ [ Advanced Threat Mitigation: SME/TME & IOMMU Active ] │
├──────────────────────────────────────────────────────────────────────┤
│ HOST OS: DEBIAN 13 (TRIXIE) SECURE │
│ Storage: LUKS2 Encrypted LVM Thin Pool (Hardware-Bound Keys) │
├──────────────────────────────────────────────────────────────────────┤
│ DOCKER CONTAINER FABRIC │
│ │
│ ┌────────────────────────────────────────────────────────────────┐ │
│ │ TRAEFIK INGRESS PROXY │ │
│ │ [ TLS Termination & Layer 7 HTTP/TCP Routing ] │ │
│ └──────┬────────────────────────┬────────────────────────┬───────┘ │
│ │ │ │ │
│ ▼ ▼ ▼ │
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │
│ │ IDENTITY │ │ CORE │ │ SOVEREIGN │ │
│ │ & ACCESS │ │ COMMS │ │ STORAGE │ │
│ ├──────────────┤ ├──────────────┤ ├──────────────┤ │
│ │ - Defguard │ │ - Matrix │ │ - Nextcloud │ │
│ │ - VPN Gateway│ │ - LiveKit SFU│ │ - Office │ │
│ │ - Vaultwarden│ │ - Stalwart │ │ - PostgreSQL │ │
│ │ │ │ │ │ - Redis │ │
│ └──────────────┘ └──────────────┘ └──────────────┘ │
└──────────────────────────────────────────────────────────────────────┘
Network Boundary & VPN Controls
To minimize the public attack surface, all administrative and authenticated interfaces are shielded behind the built-in WireGuard VPN (managed by Defguard). The Traefik ingress proxy enforces this via an IP Allowlist middleware (vpn-only@docker), instantly dropping traffic that does not originate from the internal VPN subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
However, for sovereign communication appliances to interact with the outside world, specific endpoints must be allowed public internet access. Traefik achieves this by selectively detaching the VPN middleware from explicit “Public Routers” or by bypassing Traefik entirely via direct host port mappings.
Split-Routing Topology
PUBLIC INTERNET (WAN)
│
┌────────────────────────────┴─────────────────────────────┐
▼ ▼
┌────────────────────────┐ ┌─────────────────────────────────┐
│ STRICT VPN INGRESS │ │ PUBLIC ACCESS INGRESS │
│ (Traefik IP Allowlist) │ │ (No Middleware Restriction) │
└────────────┬───────────┘ └────────────────┬────────────────┘
│ │
▼ ▼
┌────────────────────────┐ ┌─────────────────────────────────┐
│ - Nextcloud Web UI │ │ - Nextcloud Share Links (/s/) │
│ - Matrix Client API │ │ - Matrix Federation (/_matrix/) │
│ - Vaultwarden │ │ - Stalwart JMAP / Webmail │
│ - Stalwart Admin Panel │ │ - OIDC Callbacks & ActiveSync │
│ - Defguard Dashboard │ │ - LiveKit Conferences │
└────────────────────────┘ └─────────────────────────────────┘
│
▼
┌─────────────────────────────────┐
│ DIRECT PORT BINDINGS │
│ (Bypasses Traefik Entirely) │
├─────────────────────────────────┤
│ - SMTP / SMTPS / IMAP │
│ - TURN/STUN (Coturn Media) │
└─────────────────────────────────┘
- Strict VPN Services: The core applications (Nextcloud, Matrix clients, Vaultwarden) and administrative panels are completely invisible to the open internet. An attacker scanning the public IP will only receive a
403 Forbiddenfor these domains. - Public Share Links & Federation: Nextcloud’s file-sharing paths and Matrix’s server-to-server federation paths (if enabled by removing the middleware) are explicitly prioritized with a higher Traefik routing rule that omits the VPN middleware, allowing external users and remote servers to interact with shared data.
- Direct Port Bindings: High-throughput, standard protocols like SMTP/IMAP (for inbound email) and Coturn (for WebRTC media) bind directly to the host networking stack, bypassing Traefik completely to avoid HTTP overhead and ensure maximum reliability.
Operational Advantages
By combining bare-metal physical protections with Docker’s logical segmentation, this tier provides:
- Absolute Isolation: Hardware-level IOMMU and memory encryption protect against sophisticated data extraction attempts.
- Minimal Overhead: Avoiding heavy hypervisor layers ensures bare-metal CPU and memory performance is fully dedicated to the containerized workloads.
- Fast Platform Migrations: Because the entire system profile state resides cleanly within a singular directory hierarchy, executing hardware migrations requires nothing more than securely transferring the state to a new provisioned bare-metal host.