Fixed-price onboarding for self-hosted open-source apps

For a fixed price we assess your estate, put your first workload live with single sign-on and tested backups, document it, and hand you a written exit plan.

Start with one workload Book a 30-minute briefing

Price: Fixed, agreed in writing before work starts
Handover: Documentation and a written exit plan
Outcome: One production workload live, with SSO and backups
Deployment: On premises, Pilae Cloud, hybrid or air-gapped

What onboarding delivers

Onboarding ends with something in production, not a slide deck. One workload your teams use every day, running where you chose, signed into with the accounts they already have, and backed up in a way that has been proven by a restore.

An assessment of your estate

We review what you run, where your data lives, who signs in and what you need from compliance, then agree the first workload with you.

One workload live

The first app, such as private AI, file sharing or workflow automation, goes into production on your premises or on dedicated machines in Pilae Cloud.

Single sign-on wired

Users sign in through Keycloak or your existing Entra ID, with groups mapped to roles and multi-factor authentication enforced.

Backups on and restored

Daily encrypted backups go offsite to the country you choose. Before sign-off, we restore them once and record the result in your console.

Documentation you keep

Architecture, network paths, accounts, backup schedule and runbooks, written for your team and delivered as files you own.

A written exit plan

How to take your data and your apps elsewhere, including away from Pilae, with the formats, the steps and who does what.

A fixed-price start with open-source apps

Most self-hosting projects stall between the proof of concept and production. The demo works, then someone asks about sign-in, backups, the firewall and who is on call, and the project waits. Onboarding answers those questions for one real workload, for a price you know before you sign.

The first app goes where you decide: on your premises, in Pilae Cloud on dedicated machines in Switzerland and the EU, or across both. It answers only on the private network, behind one hardened gate on port 443, and monitoring probes it every 60 seconds from the day it goes live.

Single sign-on and backups from day one

Users sign in with the accounts they already have, through Keycloak or your existing Entra ID. Groups map to roles in the app, and multi-factor authentication is on. If you need more than the first app wired, SSO and identity extends it across your estate.

Backups are daily, encrypted and stored offsite in the country you choose. We restore them once before sign-off and record the result in the control plane, so the first backup your auditors see is one that has already been restored. Read how backups and restores work after onboarding.

Documentation and an exit plan you own

You receive the architecture, the network paths, the account inventory, the backup schedule and the runbooks as files your team keeps. You also receive a written exit plan: how your data leaves, in which formats, and how the apps pass to another operator or to your own staff.

From there, the next workloads follow the same pattern, often as a migration off SaaS, and managed operations can take over the running. See pricing, or contact us to scope your onboarding.

How onboarding runs

Assess
Workshops with your IT, security and business owners. We map apps, data, identities and constraints, and agree the first workload.
Fix the scope and price
You receive a written scope with deliverables, dates and a fixed price. Anything outside it is quoted before it starts.
Build
Machines, private network, the hardened gate, the app, single sign-on and backups, each change planned by the Pilae Agent and approved by you.
Test and go live
A restore test, sign-in checks with real users and monitoring switched on. Then your teams start using it.
Hand over
Documentation, an admin session for your team and the exit plan, reviewed together before sign-off.

What your contract includes

Fixed price: One price for the agreed scope. Changes to scope are quoted in writing before any work on them.
Production workload: The agreed app running in production, in the location and deployment model stated in the contract.
Identity: Single sign-on through Keycloak or Entra ID, with group mapping and multi-factor authentication.
Backups: Daily, encrypted, stored offsite in your chosen country, with one restore test recorded before sign-off.
Documentation: Architecture, runbooks and account inventory, delivered as files you own and can share with auditors.
Exit plan: Data formats, export steps and responsibilities for leaving Pilae, written and delivered at handover.

The apps behind it

Open WebUI

A chat interface over models you host, so prompts and the documents people paste into them never leave your network.

Replaces ChatGPT Team, Microsoft Copilot

Nextcloud

Files, calendars and shared documents for the whole organisation, on storage you can point at in a room you control.

Replaces Google Drive, Dropbox, SharePoint

n8n

Workflow automation your own team writes, running next to the systems it talks to instead of reaching them across the internet.

Replaces Zapier, Make

Keycloak

Single sign-on for everything else you run, with your own directory as the source of truth and no per-seat bill between you and it.

Replaces Okta, Microsoft Entra ID

NocoDB

A spreadsheet interface over a real database, so a department can build the tool it needs without anyone provisioning a new system.

Replaces Airtable

Outline

A fast, well-structured team wiki and knowledge base, on a server you choose, signed in through your own identity provider.

Replaces Notion, Confluence

Questions

What does fixed-price onboarding include?

An assessment of your estate, one production workload live with single sign-on, daily encrypted backups with a recorded restore test, documentation of the setup, and a written exit plan. The exact scope and price are agreed in writing before work starts.

How is the price fixed?

After a first conversation about what you run and what you want live first, we write a scope with deliverables and dates and put one price on it. Work outside that scope is quoted separately and only starts once you accept it. Pricing is on request.

Which workload should we start with?

Usually the one with the clearest owner and the most visible benefit: private AI for staff, file sharing to replace a public cloud drive, or automation to replace a SaaS workflow tool. The assessment recommends one and you decide.

Can onboarding happen on our own servers?

Yes. Onboarding works on your premises, on dedicated machines in any of 12 Pilae Cloud regions, in a hybrid setup, or in an air-gapped environment where engineers work through an access path you control.

Why does onboarding include an exit plan?

Because the reason to run open-source and source-available apps is that you can leave. The exit plan states how your data is exported, in which formats, and how the apps are handed to another operator or to your own team.

What happens after onboarding?

You can run the workload yourselves with the documentation, or Pilae operates it under a managed operations plan with patching, monitoring, monthly restore tests and a 99.9% monthly availability commitment.

Services

Put your first workload live, for a fixed price.

Tell us what you run and what you want to move first. We come back with a scope, a timeline and a fixed quote.