One file becomes a company.

Managed Kubernetes on servers rented at auction from spare data-center capacity. They are older Xeon machines, cheap and good enough for everything we run.

instead of on-demand cloud VMs

Applies whatever is in Git, wave by wave, and waits for each wave to be healthy before starting the next. It also bumps image tags after each build and creates one environment per open pull request.

instead of deploy scripts and clicks

The cluster has no public IP and no load balancer. It opens an outbound tunnel to Cloudflare, which handles DNS, TLS at the edge and access checks for admin tools.

instead of paid cloud load balancers

Routes each hostname to the right service using the Kubernetes Gateway API. It also adds single sign-on in front of tools that have none of their own.

instead of a hosted API gateway

Issues and renews every certificate inside the cluster. Nobody copies certificate files around.

instead of manual certificate renewals

Each product gets its own Postgres cluster, and each preview gets its own copy. The operator handles failover, point-in-time backups and restores.

instead of managed RDS or Supabase

A Redis per product for caching, sessions and rate limits, run by an operator, with Redis Insight behind platform sign-in for inspection.

instead of hosted Redis

S3-compatible storage for uploads, attachments and backups. Any S3 client works unchanged, so apps don't know it isn't Amazon.

instead of Amazon S3

Every product has a secrets project with prod and dev environments. The platform writes generated keys into it, and the cluster pulls them back as environment variables.

instead of Doppler or Vault Enterprise

The few platform secrets that live in the repo are encrypted file by file, so the Git history never contains a readable key.

instead of keys pasted into CI settings

A new route publishes its own Cloudflare DNS record. It starts in wave 3 because it needs the Cloudflare token from Infisical.

instead of editing DNS by hand

Database backups, Git data and the secrets key are copied off the cluster to B2. The bucket uses Object Lock, so the key that writes backups cannot delete them.

chosen over R2, which lacks S3 Object Lock

Apps send OpenTelemetry to Alloy, which stores logs, traces and metrics. One trace follows a click from the browser through the API to the background worker.

instead of Datadog or New Relic

Front-end errors and page timings from real users, joined to the same traces as the backend.

instead of Sentry or LogRocket seats

One Keycloak serves everything. The team signs in once to every internal tool. Each product gets its own realm for its customers, with passkeys, a branded login page, and B2B workspaces when a product needs them.

instead of Auth0 or Clerk, priced per active user

Preview environments sign in against their own realm, so a test build can never read or change real customer accounts.

instead of test users inside production

Turns one Project file into about 75 resources across every tool on this page: realms, databases, buckets, topics, secrets, CRM, campaigns. It also drives the AWS side of email (SES, SNS, IAM). Deleting the file cleans everything up.

instead of a setup checklist

One CloudNativePG cluster for the platform's own tools, with a database each for Keycloak, Twenty, Plunk and others. Products never use it; they get their own.

instead of a managed database per tool

Our own Git server and container registry. Each product has an organization, and images are stored next to the code.

instead of GitHub seats and package storage

Pipelines live in each repo and run inside the cluster: test, build, end-to-end. Tekton Chains signs every image and records how it was built.

instead of paid CI minutes

Opens a pull request for every new version each Monday. Small tools update themselves after checks pass. Databases and control-plane parts wait for a human.

instead of forgotten upgrades

A Kafka-compatible event log on three brokers. Each product writes only to topics under its own name, and topics are files in the repo, created and removed with the code.

instead of Confluent Cloud or SQS

Transactional email and an in-app inbox, on its own MongoDB replica set. Notification designs live in the product's code as React Email templates. Previews send to a test inbox, so a test never emails a real person.

instead of Knock or Courier

The front door. A form asks for a name and who the customers are, then opens the pull request that creates the product. It also lists every service and who owns it.

instead of a wiki page nobody updates

One Twenty for the whole platform, one workspace per product at crm-<slug>.xupisco.com, plus a -dev workspace for previews. Our build lifts the open-source edition's limit of five workspaces, and that source is public on our Git server.

instead of HubSpot or Salesforce seats

One Plunk for the whole platform, one campaign space per product, sending from <slug>.news.xupisco.com. Sequences live in the product's code, with double opt-in and one-click unsubscribe. SES delivers. A watch on bounces and complaints pauses sending if they rise. Our fork adds Keycloak sign-in, and its source is public.

instead of Mailchimp or Loops

Defines what a Project file may say (name, B2C or B2B, payments, campaigns) and how Crossplane builds it. The cluster rejects a file that breaks the rules before anything is created.

instead of tribal knowledge

wiseresume, wiserecruit, demo2 and b2b, each with its own database, sign-in realm, CRM workspace and verified campaign domain. Two pull-request previews are open as of 1 October 2026.

instead of one shared app for everything