InHouseCloud

The company's own cloud on one machine: an agent installs it, and an agent puts apps on the air in it.

One box runs what a small company needs around its internal apps: single sign-on (Authentik), Git with push-to-deploy (Gitea and Actions), shared Postgres and Redis, a portal, an MCP gateway for AI clients and a nightly backup, all behind one sign-in and under one contract an agent can read. The box can be a Mac with Docker Desktop, a VM on a laptop or a server in the office. Open source, MIT.

Documentation: https://inhousecloud.estoca.com.br/ (built from docs/).

Sibling project: InHouseOS is the people-and-work half (a personal LLM agent per person, a second brain, a shared tracker, a company compass). It runs on top of this cloud as ordinary apps and is adopted separately.

Try it in 10 minutes

On a Mac with Docker Desktop, directly (15 to 20 GiB free; no sudo):

git clone https://github.com/Estoca/inhousecloud.git ~/src/inhousecloud && cd ~/src/inhousecloud
./install.sh --non-interactive --config bootstrap/config.example.yaml --install-dir ~/inhousecloud

Or in a throwaway VM, on a Mac with Homebrew and no Docker (or skip the VM on any Ubuntu box with Docker):

brew install lima
limactl start --tty=false --name ihc --cpus 2 --memory 4 --disk 30 template:docker
limactl shell ihc
# inside the VM:
cd ~ && git clone https://github.com/Estoca/inhousecloud.git && cd inhousecloud
sudo install -d -o $(id -un) -g $(id -gn) /opt/inhousecloud
./install.sh --non-interactive --config bootstrap/config.example.yaml

About a minute for the VM and five for the install. The install ends with seven day-zero steps, with the literal commands: open http://portal.cloud.localhost and sign in, turn on MFA, copy the backup key off the machine, put a first app on the air with scripts/ihc-app.sh new <name> --owner <email> --push (about 30 seconds later behind the same sign-in), and stop or remove a test install (docs/cleanup.md). Both paths, with the times measured: docs/try-it.md.

Or ask a coding agent. Below, Claude Code gets one sentence in Portuguese ("create an internal expense log app on our company cloud and put it on the air") and ssh to a box it has never seen; recordings and how they were made are in docs/demo/.

Proven by record

Each of these ran on a clean machine and is written down with the commands, the times and what broke, in docs/first-run.md:

• the core install and its smoke tests, and an app from new to the air by a push to main (app loop);
• on a Mac with Docker Desktop, no VM (macOS run);
• a coding agent that has never seen the cloud installs it from a layperson's request, about 8 minutes, no password in the conversation (cold install run), and puts a new app on the air, about 2 minutes (cold agent run);
• private ingress over Tailscale with the installation's own CA (private ingress run);
• the portal with people and groups, its status API for agents, and the MCP gateway with a real client (portal, people, portal API, MCP gateway);
• ihc doctor against failures caused on purpose (doctor run), and the operator agent in a conversation (operator run).

Profiles

The core (proxy, Authentik, Gitea with its runners, shared Postgres and Redis, the portal, the MCP gateway, the backup) is always on. Each profile adds:

Profile	Adds
storage	Garage, S3-compatible object storage: a bucket and key per app
ops	Portainer, Glances, a web terminal and a file browser, for admins only behind the SSO
agent	an operator agent that answers "why is it down" in Slack or Telegram, read only by default, inside a written contract

For agents

Start at AGENTS.md: it routes an install, a new app or "why is it down" to the contract and the playbook (docs/llm-bootstrap.md, docs/agent-setup-contract.md, docs/operator-contract.md). Off the box, an agent reads the cloud's health through the portal API, and a person's AI client uses it through the MCP gateway.

Status

Usable on one box, with local ingress (on the machine itself) or private ingress (Tailscale, tested end to end). The portal has people and groups and a read-only status API for agents; the MCP gateway serves read-only tools, and every new app is born with one. Next: write tools and an audit log in the gateway, restoring one app on its own, and the off-site backup copy. public ingress, for a cloud on the open internet, comes after that: the installer has the modes, and they get their own run first. Everything done and ahead: status and roadmap.

Documentation

The site, https://inhousecloud.estoca.com.br/, has six parts, all from docs/:

• Start: try it, day zero, the first person after you, install and deploy, quickstart.
• Concepts: one machine, one cloud, the deploy loop, why it exists.
• Operate: doctor, backup, stop or remove, runbooks, security, install design.
• Build apps: app contract, MCP in an app, , .

Preview it locally: pip install -r docs/requirements.txt && mkdocs serve.

License

MIT, see LICENSE.