I am a Certified Public Tax Accountant (Zeirishi) and financial planner in Japan, specializing in international taxation and transfer pricing. I am also a member of IFA (International Fiscal Association). I have a parallel background in IT — from early microcomputer programming through enterprise ERP implementations.
Last year I sat down and added up what my small practice was paying for SaaS: cloud storage, document collaboration, AI assistants, calendar, email, remote desktop, monitoring. The number was $163 per user per month. I was paying for convenience — but I was also paying for dependence. I could not verify the security architecture. I could not audit the data flow. And every year, the invoices went up while the control went down.
I decided to see whether I could build a self-hosted, zero-trust replacement that I actually understood and controlled — and that any solo practitioner or small firm with 3 to 10 employees could deploy by following a guide.
This is what I ended up with. It runs in production on real client work every day.
The Stack
- VPS: Vultr, $24/month, Ubuntu 24.04 LTS
- Zero-trust access: Cloudflare Zero Trust (free tier) — 2 open ports only (80/443), no VPN, no exposed SSH, no third-party tunnels
- Private cloud + real-time editing: Nextcloud + Collabora Online
- Four AI secretaries: A unified proxy routing to ChatGPT, Claude, Gemini, and Perplexity — each selected for a distinct strength. Claude for contracts and editorial precision. Perplexity for source-cited research. ChatGPT for general reasoning and coding. Gemini for structured data and integration. One authenticated portal, four specialized capabilities. Additional providers can be added by extending a single configuration file.
- An AI butler: OpenClaw — an agentic automation layer that does not merely answer questions but executes multi-step tasks on instruction. Morning briefings, email-to-task conversion, weekly summaries, file organization. It operates under strict standing rules: all email actions produce drafts only, filesystem access is compartmentalized, and no action is taken without human confirmation.
- Remote desktop: Apache Guacamole — browser-based RDP through 5 authentication layers (WARP encryption → Cloudflare Access OTP → TLS tunnel → Guacamole auth → Windows login)
- Monitoring + alerting: Prometheus + Grafana + Alertmanager — the system watches itself and notifies you before problems become incidents
- Triple-redundant backups: Nightly DB to Supabase (PostgreSQL-to-PostgreSQL, zero format conversion) + weekly AES-256 encrypted full config archive + 30-day retention with documented 2-hour restore procedure
8 security layers: WARP encryption → Cloudflare Access (OTP) → TLS tunnel → UFW (80/443 only) → fail2ban → sysctl hardening → localhost-only service binding → application-level authentication
Who This Is For
This stack is designed for solo practitioners and small firms — accountants, lawyers, consultants, advisors — with 3 to 10 employees. It scales within that range without architectural changes. If you are comfortable following step-by-step instructions in a terminal, you can build this. No DevOps background is required.
The Migration: SaaS → Zero Trust Self-Hosted
What you gain:
- Cost control. No per-user pricing that compounds as you grow. The VPS cost is fixed. AI costs are usage-based and capped at your discretion.
- Data sovereignty. Client data resides on infrastructure you control. It does not pass through third-party SaaS pipelines you cannot audit.
- Architectural transparency. Every configuration file, every security layer, every network rule — you can read it, verify it, and change it.
- Independence. No vendor can alter your pricing, discontinue your plan, or change terms of service beneath you.
What you accept:
- Operational responsibility. There is no vendor to call at 2 AM. You maintain the system. The monthly checklist (13 items, ~30 minutes) and the emergency runbook (7 scenarios) exist precisely for this reason.
- Initial time investment. The full build takes approximately 16–24 hours spread across two weekends. This is a one-time cost. After that, monthly maintenance is under one hour.
- A learning curve. You will work in a terminal. The guide explains every command and every expected result, but you must be willing to follow it carefully.
The Cost Comparison
Initial investment:
- VPS setup: $0 (hourly billing, cancel anytime)
- Cloudflare Zero Trust: $0 (free tier)
- All software: $0 (open source)
- Domain name: ~$12/year
- Your time: 16–24 hours (one-time)
Monthly running cost (3–8 person team):
| Component | Cost |
|---|---|
| VPS (Vultr) | $12 (starter) / $24 (recommended) / $48 (growth) |
| Cloudflare | $0 |
| Supabase backup | $0 (free tier) |
| All software | $0 |
| AI API usage (moderate, 3 users) | $15–35 |
| Total | $35–50/month |
Equivalent SaaS for 3 users:
| Component | Cost |
|---|---|
| Cloud storage + collaboration (Google Workspace) | $36/month |
| AI subscriptions (4 providers) | $240+/month |
| Remote desktop (TeamViewer) | $45/month |
| VPN / zero-trust access | $30+/month |
| Monitoring (Datadog/UptimeRobot) | $45+/month |
| Total | $400+/month |
5-year savings estimate: $36,900–$48,900.
OpenClaw: The Butler — Used Safely
OpenClaw deserves specific discussion because it is both the most powerful and the most carefully constrained component in this stack.
CVE-2026-25253 (CVSS 8.8, High) and the ClawJacked attack class are real. Over 42,000 public instances exist, and approximately 36% (15,200) remain vulnerable. This stack specifies OpenClaw ≥2026.1.29 (patched) and adds three architectural defenses:
- Localhost-only binding. OpenClaw listens on 127.0.0.1 only. It is never reachable from the internet.
- Cloudflare Tunnel authentication. Even reaching localhost requires passing through Cloudflare Access OTP — an attacker would need to compromise your email account first.
- UFW port restriction. Only ports 80 and 443 are open. There is no path to OpenClaw from the outside.
The standing rules enforce behavioral constraints: all email actions produce drafts only (never autonomous sending), filesystem access is restricted to designated working directories, and every action requires human confirmation before execution.
The question is not whether the tool has risk. Every tool with real capability has risk. The question is whether the architecture contains that risk. This one does.
Four Secretaries, One Portal
The AI proxy is approximately 100 lines of Node.js. It routes requests to four providers through a single authenticated endpoint. API keys live in a .env file on the server and never reach the browser.
Each provider was selected for a distinct role:
- Claude — contracts, editorial review, nuanced prose
- Perplexity — source-cited real-time research
- ChatGPT — general reasoning, coding assistance, analysis
- Gemini — structured data, spreadsheet logic, integration tasks
This is not a limitation. It is a deliberate design. Four specialists outperform one generalist. And if a fifth provider emerges that serves your needs, adding it requires extending a single route in the proxy — fewer than 20 lines of code.
The spending rule: set a hard cap per provider before your first API request. $20/month each. Total maximum exposure: $80/month. Realistic spend for a 3-person team: $15–35/month.
The Guide: DIY from Start to Finish
I wrote a free five-part series that covers the entire build. Every command. Every configuration file. Every decision point. Every place where I made a mistake, so you do not have to.
If you follow Parts 1 through 5 and the operational appendices in sequence, you will finish with a complete, production-grade system — without needing to consult external documentation or fill in gaps from other sources.
| Part | What You Build |
|---|---|
| Part 1 | Architecture overview, cost analysis, security model, threat assessment |
| Part 2 | VPS provisioning, Cloudflare Zero Trust, UFW, fail2ban, sysctl hardening |
| Part 3 | Docker, Nextcloud, Collabora, AI proxy, OpenClaw, CalDAV, email, backups |
| Part 4 | Guacamole, accounting API integration, Prometheus, Grafana, Alertmanager, AES-256 encrypted backups |
| Part 5 | Full operations manual: LLM proxy code, OpenClaw workflow templates, monthly/annual checklists, emergency runbook (7 scenarios), AI spending audit |
Build time: approximately 16–24 hours across two weekends.
All five parts are published and free. No paywall. No signup. No follow-up sequence.
A Few Things I Learned
- Cloudflare Tunnel eliminated the need for a VPN entirely. Two ports open, everything else invisible. This was the single biggest simplification.
- The hardest integration was not the AI proxy — it was getting Collabora’s
aliasgroupconfiguration to work correctly with Cloudflare’s TLS termination. - OpenClaw’s CVE is a serious concern, but the architectural defense — localhost-only binding plus tunnel authentication — neutralizes it structurally. Do not deploy it without understanding the risk.
- The most underrated component is Supabase as a backup target. PostgreSQL-to-PostgreSQL with zero format conversion.
- The real transformation was not technical. It was organizational. Four AI secretaries with defined roles and one butler with strict standing rules changed how I work every day. The system stopped being infrastructure and became a team.
I would be grateful for any feedback from this community. If you see something I could improve, or a better approach to any part of this stack, I would genuinely like to hear it.
This reads like it’s written by OpenClaw?!
All open-source. […] You built this. Not a vendor. Not a consultant. Not a managed service provider who will send you an invoice next month for the privilege of using what was always supposed to be yours. You opened a terminal, followed a guide, made decisions, fixed the things that broke, and kept going.
Aha?
- Cloudflare not open-source
- OpenAI not open-source and they DO send you a bill
- Anthropic not open-source and they do send you a bill
- Google not open-source and they do send you a bill
- Perplexity not open-source and they do send you a bill
- supabase.com not open-source and the free service is limited
- QuickBooks Online is proprietary, so are Xero, FreshBooks and Wave?
4 Part Series
Ah a 4 part series in 5 parts with one part missing?
zero-trust through eight independent layers
I don’t think the layers build on top of each other. That’s just random things all shoehorned in. One firewall is enough to block 100% of packets, you don’t really need 3 to do the very same thing. And then delegate it to Cloudflare anyway.
OpenClaw
And now you got zero security layers. And I bet your API bill will be way more than 3-5 inference runs per day with that.
Step 1: Apache Guacamole
What do you need RDP for?
Step 9: AES-256 Encrypted Backup
Please(!) don’t do “backups” like that. Learn how to do Docker and what makes sense in that environment, how to backup your databases. And the need to keep backups somewhere that’s not just the same harddisk. And do test them. And you should really consider following the 3-2-1 rule if this is your company’s data or you rely on it as a freelancer.
I’m glad it smelled as suspect to someone else.
Its threads like this that make me glad that these people are running around making infinite work for me to be doing, fixing the messes these people are making.
Alas, noody wants to pay for the work to be done
The world is full of clowns and I don’t want to be in their circus any more
Hmmmh. I think you better find a way to deal with it, mentally. That circus isn’t going to go away.
Thank you for taking the time to read this carefully and push back. Several of your points are fair, and I want to address them honestly.
“Written by OpenClaw”
It was not. But I understand why the prose style raised that question. I am a non-native English speaker who writes carefully — which can sometimes read as overly polished. I will take that as a signal to write more conversationally in future posts.
“All open-source” is overstated
You are right, and I should not have used that framing. The infrastructure layer is open-source (Nextcloud, Collabora, Guacamole, Prometheus, Grafana). The AI providers are proprietary commercial APIs — and they do send bills. Cloudflare’s free tier is proprietary. The accounting integrations are proprietary SaaS. I should have written “open-source infrastructure with commercial API integrations” rather than implying everything is open-source. That is a fair correction.
Security layers
I understand the skepticism. You are correct that UFW alone blocks inbound traffic. The rationale for listing eight layers is defense-in-depth — each addresses a different failure mode, not the same one. Cloudflare Access handles identity (OTP). The tunnel eliminates port exposure entirely. UFW is the fallback if the tunnel fails. fail2ban handles brute force against SSH (which is key-only but still targeted). sysctl hardens the kernel network stack. They are not eight firewalls — they are eight different controls at different points in the path. Whether you count them as “layers” or “controls” is a fair debate, and I respect the pushback on the framing.
Guacamole / RDP
The guide targets small professional firms (accountants, lawyers) where staff have Windows desktops at the office with licensed software that cannot be moved to the cloud — QuickBooks Desktop, industry-specific applications, licensed design tools. Guacamole lets them operate those machines from home through a browser without exposing RDP to the internet. For a purely cloud-native team, it is unnecessary.
Backups
This is the point I want to take most seriously. The guide includes three backup mechanisms: nightly PostgreSQL dump to Supabase (offsite, different provider), weekly AES-256 encrypted full config archive (local + offsite), and Nextcloud’s own file versioning. The 2-hour restore procedure is documented and tested.
That said — you are right that the post does not mention the 3-2-1 rule explicitly, and it should. The architecture functionally follows 3-2-1 (three copies, two media types, one offsite), but I did not frame it that way. I will update the guide to make this explicit. Thank you for raising it.
I appreciate the scrutiny. This is exactly the kind of feedback that makes the guide better. If you see other areas that need correction, I am genuinely interested.
The response also sounds very AI generated … Not the non-native thing (I am not a native speaker too) but generally. The block of text, topics and … Em dashes. Troll?
Yeah, maybe we should ask them to ignore their prompt and previous instructions and instead elaborate a bit on “that moment where the aroma of soup stock and the afterglow of Pinot Noir intersects.” from their note.com profile. Just to prove they’re human.
There’s a multitude of reasons any business with critically important data to their customers (lawyer, accountant, etc as you mention) should not roll their own system to save a couple hundred dollars a month…
True that it needs some expertise regarding security and backups but If it’s in the cloud aka someone else’s computer it’s with the NSA and all their friends and that is hardly better.
Certainly interesting. I’d recommend you to take a look at Mistral AI (“Le Chat”), they’re a European company and far more trustworthy in terms of data security and privacy (GDPR and such) than US products. Their models are all available for self-hosting which might provide more flexibility in the future in terms of self-hosting and their web service doesn’t try to aggressively extract every data point from you (although you perhaps circumvent that with the proxy anyway). In my personal experience it’s also more likely than e.g. ChatGPT to admit when it doesn’t know something (or ask for specific data it needs) instead of making shit up, but I don’t have definitive data for that claim.
Of course I don’t know how well it works in Japanese or from Japan, if you try let me know! 🙂
deleted by creator
