Self-hosting your office: one VPS, zero SaaS

Most collaboration tools treat self-hosting as an enterprise afterthought: a crippled installer, a pricing call, a PDF. We think it's table stakes. If a tool carries your team's every conversation, "trust us" shouldn't be the only deployment option.

This post walks through what actually runs when you self-host a floor, and why it fits on one modest VPS.

The whole stack, honestly

A self-hosted floor is four processes, shipped as one Docker Compose stack:

1. A WebRTC media server (SFU) — routes audio and video between participants. This is the only component that touches your calls, and your calls never leave it: media is peer-to-server-to-peer, end-to-end inside your box.
2. An application server — accounts, floors, chat history, and short-lived media tokens. Backed by a single embedded database file; backups are cp.
3. A reverse proxy — terminates TLS and routes three paths: the app, the realtime socket, and media signalling.
4. Redis — coordination for the media server. Small, boring, reliable.

That's the entire dependency graph. No managed database, no message queue, no object storage, no third-party API in the hot path.

Sizing: smaller than you think

Video conferencing has a reputation for being infrastructure-hungry, but an SFU doesn't transcode — it forwards. For a 30-person team with normal usage (a few simultaneous conversations, occasional all-hands), a 4 vCPU / 8 GB VPS runs the whole stack with headroom. Bandwidth, not CPU, is the number to watch: budget roughly 4 Mbps per active video participant at peak.

What you gain (beyond the obvious)

Data sovereignty is the headline, but day-to-day, teams self-host for quieter reasons:

• Latency you choose. Put the box in the region your team actually lives in. A Sydney team on a Sydney VPS sees audio latency drop noticeably versus any global SaaS.
• No per-seat maths. A flat infra cost changes behaviour: teams invite contractors, clients, and candidates onto guest floors without a procurement conversation.
• Boring compliance. "Where is the data?" becomes a one-line answer in a security questionnaire instead of a vendor-review saga.

What you take on

Honesty requires the other column: you own updates (a docker compose pull away, but you own them), TLS renewal, backups of one database file, and the firewall rule above. For a team with any ops capability, it's an hour a month. For a team with none, our cloud exists — same floor, same features, our pager.

The point isn't that everyone should self-host. The point is that the choice should be real. An office you can't own is a lease; we'd rather sell you the building.