Skip to content

Transition to 'Office in the Cloud' at Strato

General

The customer is transitioning their infrastructure to a Linux-based ecosystem to ensure full digital sovereignty.
This move aligns their primary operations with European cloud services to guarantee strict adherence to regional data privacy standards and mitigate geopolitical dependencies.

Conditions

  • Digital Sovereignty: Act independently in the digital world without foreign dependence.
  • Data Residency: Ensuring data is stored and processed exclusively within European borders.
  • Technological Autonomy: Freedom from proprietary ecosystems and foreign jurisdictions.
  • Open Strategic Autonomy: Reducing reliance on non-European tech giants.

Implementation

The implementation is built around a centrally hosted Linux environment at the Strato data center in Europe, combined with a secure VPN tunnel to the customer's local on-premises network.

At the heart of the setup is a dedicated host (office.example.com) running two LXC containers. The primary container (kde) provides a full KDE desktop environment with an integrated CUPS print server and a Nginx web server, and acts as the WireGuard VPN client. A second container (search) runs alongside it, connected to the kde container via a local LAN (10.0.3.0/24). Both containers share access to centrally managed file storage via bind mounts, which also hold the SSL certificates that are automatically renewed by a scheduled cronjob.

Users on the local LAN connect to the cloud desktop through Remote Desktop Protocol (RDP), providing a seamless, location-independent office experience without the need for Windows licenses or proprietary desktop software. All printing is handled centrally through CUPS in the cloud container, which manages four local network printers across the on-premises LAN --- covering A4 color and black-and-white laser printing as well as small and standard label printing.

The local infrastructure consists of a WireGuard-capable router/switch serving as the VPN server endpoint, a Synology NAS for file backup and Git repository hosting (synchronized from the cloud via rsync over SSH), and a Windows Server integrated via SMB for legacy compatibility. The encrypted WireGuard tunnel between the cloud container and the local router ensures that all communication between the Strato data center and the on-premises network remains private and secure.

This architecture guarantees that all data is processed and stored exclusively within European infrastructure, while giving employees a consistent, fully managed Linux desktop experience accessible from any workstation on the local network.

Network Topology

The diagram below provides an overview of the technical infrastructure underpinning the cloud office solution. It shows how the centrally hosted environment at the Strato data center connects to the customer's local network via an encrypted VPN tunnel, enabling seamless access to desktop services, printing, and file management from on-premises workstations.

uml diagram

Mail Archive and Full-Text Search

To complement the cloud office environment, a Dovecot IMAP server is integrated into the infrastructure to serve as a shared local mail archive, giving all users centralized access to the archived e-mail correspondence.

A lightweight Python-based web application provides browser access to the mail archive. To ensure that attachments and office documents are fully readable without requiring local software installations, all files are automatically converted to PDF on the fly using a headless LibreOffice instance.

All content, both the mail archive and the files stored on the server, is made available to the search container via bind mounts, where the open-source crawler and indexer Fess indexes everything into a single, unified full-text search interface. This allows users to search across emails, attachments, and documents from one central location.

All web-facing services, including the mail viewer and the search interface, are routed through a hardened Nginx reverse proxy. TLS/SSL certificates are provisioned by the host and injected into the kde container via a bind mount, ensuring that all traffic is encrypted and that certificate management remains centralized and automated.

Data Safety and Backup

Data integrity and recoverability are central to the infrastructure design. Backups are performed using rdiff-backup, a proven open-source backup tool that combines the best of two worlds: it maintains a current mirror of the source data while simultaneously storing reverse differential increments. This means the backup directory always reflects the latest state of the data, yet any previous version can be recovered going back through the full backup history. All without the storage overhead of repeated full backups. Rdiff-backup operates efficiently over SSH or locally, transmitting or copying only the changes since the last backup run, comparable to rsync but with the added benefit of full versioning.

The backup archive is exposed as a read-only file system using rdiff-backup-fs, allowing administrators to browse and restore individual files from any retained backup date without running restore commands. The mounted view shows all restore points, the actual number of available restore points is only bounded by the configured retention policy and the disk-space available on the server. The backup archive is intentionally excluded from the Fess search index, as exposing multiple historical copies of all content would introduce unnecessary duplication in search results.

For redundancy, the complete backup directory is synchronized to two additional locations using rsync the on-premises Synology NAS on the local LAN, and a secondary offsite destination reachable via rsync over SSH. This three-location strategy, cloud, local NAS, and offsite, ensures that data remains recoverable even in a complete failure event of the primary hosting environment.

Finally, because the majority of the infrastructure runs inside LXC containers, the entire setup is inherently portable. Migrating to a different hosting provider, or to a newer server at Strato when an OS upgrade is required, is a straightforward process of transferring the containers rather than rebuilding the environment from scratch.