Open source is free. Running it is not. Here is every system we would deploy, operate and hand over, and what each one costs to have run.

00

Talk.

Chat, mail, lists, meetings and teaching.

Chat and calls: Matrix

• Matrix, on Synapse, with the client left to you. For an organisation that runs its working day through a messenger and would rather the rooms and the history sat on a machine with its name on it. In place of Slack, Teams as a messenger, or Discord. Its own machine. The whole of it is on the Matrix page.

Mail

• Mail on your own machine, arriving. For an organisation whose address is its identity. In place of a hosted mailbox. The server is not the hard part. Sender policy, signatures, a published alignment policy, transport encryption required rather than hoped for, and the certificate pinned in DNS are the hard part. A domain already carrying years of bad practice is a project rather than a setting, and it is sized separately. Its own machine. The open stack page names the tests you can run against our own domain first.

Lists and newsletters

• Mailman 3 for a list people talk on, listmonk for a letter you send out. For membership bodies, alumni groups and anyone whose announcements currently leave through a platform that keeps the list. In place of Mailchimp, Brevo or a hosted group. It runs on a deployment that already sends mail properly, with the sending domain kept separate from the one people reply to, because bulk sending puts a reputation at risk and the reputation is the thing that decides whether any of it arrives.

Meetings: Jitsi Meet

• Jitsi Meet, for meetings with people who are not in your directory: a link, a browser, no account. In place of Zoom, Teams meetings or Google Meet. Video is the most expensive thing on this page to run, so it is sized before it is priced and we say so before you buy the machine. The rest is on the open stack page.

Teaching and webinars: BigBlueButton

• BigBlueButton, for teaching: slides, a whiteboard, breakout rooms, polls and a register. In place of a commercial virtual classroom charged per learner. Term start is one load spike an estate either survives or does not, so a load test is part of the work rather than an extra. Sized before priced. The comparison with the meeting engine is on the open stack page, and picking the wrong one of the two is expensive in both directions.

Every system here is open source and named in full, with its upstream project. What you buy is never the software: it is the installing, the keeping current, and being the person who is called when it breaks.

01

Files and writing.

Where documents live and where they get written.

Files, documents and office

• Nextcloud, with documents edited in the browser and nothing leaving to be edited. Seafile where sync speed at scale matters more than the suite around it. In place of Google Drive, Dropbox, OneDrive or SharePoint. Disks are finite, so how big it may get is agreed before the invoice rather than after. Its own machine. The decisions behind it are on the open stack page.

Document archive: Paperless-ngx

• Paperless-ngx. Everything that arrives as paper or as a PDF, scanned once, read by the machine, tagged, and findable by the words inside it. For practices and small institutions where the filing cabinet is the system of record and the search function is somebody's memory. In place of a scanning subscription or a shared drive of folders named after years. The retention rule per document class is set before the first scan, because an archive that keeps everything for ever is a liability rather than an asset.

Shared writing: Etherpad, HedgeDoc, CryptPad

• Etherpad for the page two people write during a call. HedgeDoc where the notes should keep a history. CryptPad where the server must not be able to read what is on it. That last one is a real property and not a setting, and it has a price: if the key is lost, nobody recovers the document, and that includes us. For the writing nobody files and everybody needs again.

Knowledge base and wiki

• A wiki that survives the person who started it. BookStack when the shape matters, Outline when the writing has to be pleasant, DokuWiki when it should be files on a disk and nothing else, MediaWiki when it is large and public. For any organisation where a procedure exists only because somebody remembers it. In place of a tool charged by the head whether or not the head writes anything. Moving an existing corpus across is engineering and is priced as engineering, not as part of the install.

Every system here is open source and named in full, with its upstream project. What you buy is never the software: it is the installing, the keeping current, and being the person who is called when it breaks.

02

Publish.

The public face, and the count of who read it.

Video: PeerTube

• PeerTube, for video you publish rather than upload. For organisations whose training, lectures or public record currently sit next to somebody else's advertisement. In place of YouTube or Vimeo as a channel. Transcoding and storage are where the money goes, and they grow with the library rather than with the audience, so this is sized before it is priced. What you give up is reach, and the open stack page says so at length.

Public writing: Mastodon

• Mastodon on your own domain, so the handle carries your name and cannot be taken away from you. For organisations whose public voice is currently a tenancy. In place of an account you hold at somebody else's pleasure. Running an instance means moderating it, including reports about other people's users, and that is work with a person in it rather than a setting.

Website, publishing and audience measurement

• A website you hold, and a count of who read it that does not leave. WordPress where people who are not engineers edit it every day, Ghost where it is writing and a letter, Hugo where it should be static files with nothing to break into. Matomo, Plausible or Umami for measurement on your own machine, with no third party in the page. In place of Squarespace, Wix, or an analytics tag that makes your readers somebody else's data. A plugin estate is a standing liability, so what we will carry is agreed before we take it on. This site itself runs no analytics, which is a choice for a page with nothing to measure and not an argument against measuring anything.

Every system here is open source and named in full, with its upstream project. What you buy is never the software: it is the installing, the keeping current, and being the person who is called when it breaks.

03

Identity and access.

Who is allowed in, and how they are let out.

Sign-in: Keycloak

• Keycloak, so an account is made in one place and, more to the point, switched off in one place. Authentik or Zitadel where Keycloak is heavier than the estate needs. For any organisation running more than three of the systems on this page, and for every organisation that has found a leaver still had access. In place of a login owned by a platform company. Identity is where a bad migration locks everybody out at once, so the old route stays live until the new one is proved. Its own machine.

Passwords and machine secrets

• Vaultwarden for the passwords people type, OpenBao for the secrets machines read. They are two problems, and one tool for both is how a list of credentials ends up in a shared folder. In place of a per-seat vault. Vault itself is not on this page because its licence is no longer an open one. OpenBao is a young fork of it, which is worth knowing before you choose it.

Remote access: WireGuard

• WireGuard, with a key per person and a revocation that revokes. Split routing, so a laptop does not send everything through you. Headscale where a mesh is genuinely the right shape. For organisations with internal systems that should not answer the internet and people who are not in the building. In place of a commercial VPN client, or a remote desktop port left open because it was quicker. This is remote access to your own systems, not a consumer service for moving between countries.

Every system here is open source and named in full, with its upstream project. What you buy is never the software: it is the installing, the keeping current, and being the person who is called when it breaks.

04

Build and ship.

Where the source lives and what comes out of it.

Code, continuous integration and artefacts

• Forgejo for the code and the reviews, runners for the build, Harbor for what comes out of it. GitLab Community Edition where its wider surface is needed. For teams whose source is the asset, and for anyone who has to say which country their repository sits in and mean it. In place of GitHub, Bitbucket or Azure DevOps. What leaving costs is the network around it: the issues, the actions and the contributors who are already there. The build gate is what you gain, and it keeps working after we have gone. Its own machine.

Error tracking: GlitchTip

• GlitchTip, which takes the same client libraries your application is probably already using. For teams who want the crash reports without sending every stack trace and every user identifier somewhere else. Named here rather than Sentry because Sentry's own licence is no longer an open one, and this page carries only software you may run and keep. It is a smaller project with less in it, and that is the trade.

Every system here is open source and named in full, with its upstream project. What you buy is never the software: it is the installing, the keeping current, and being the person who is called when it breaks.

05

Data.

Stores, queues, pipelines and the questions they answer.

Databases: PostgreSQL

• PostgreSQL, run properly rather than merely installed. Pooling, replication, a failover that has been rehearsed, and backups with a recovery point and a recovery time somebody has actually measured. MariaDB where an application demands it. For anyone whose managed database bill has grown faster than their data, and for anyone who has never tested a restore. Running your own moves the recovery obligation onto the estate: if the monitoring and the drills will not be funded, staying managed is the honest answer and we will say so. Its own machine.

Object storage

• Object storage on your own disks, speaking the API your applications already expect. Garage where the estate is small and spread across sites, SeaweedFS where the file count is very large, MinIO where an application requires that API. For estates whose media, backups and uploads sit with a hyperscaler and whose egress charges nobody modelled. What a hyperscaler really sells here is durability, so a replication factor and an off-site copy are part of the quote rather than an upgrade to it. Sized before priced.

Queues, cache and streams

• Valkey for cache and a simple queue, NATS where it should be small, RabbitMQ where the routing is the hard part, Kafka or Redpanda where the volume justifies the operational weight. For applications paying for a managed queue they use at a fraction of its size. Most estates this size do not need Kafka. Valkey is our default; both it and Redis have changed licence in the last two years, so we check which licence applies on the day and tell you before you pick.

Analytics store and reporting

• A store that answers questions, and something in front of it people can use without asking you. ClickHouse where the volume needs a column store. DuckDB where it genuinely fits on one machine, and the honest answer is often that you do not need a warehouse at all. Metabase or Superset for the reports. In place of a warehouse and a reporting seat, both of which charge for the seat as well as the query. Sized before priced.

Pipelines

• The machinery that moves data on a schedule and tells you when it did not. Airflow or Dagster to run it, dbt Core to transform it in code somebody can review, Debezium to take changes out of a live database without a nightly export that locks it. For organisations whose reporting depends on somebody remembering to run something. Pipelines rot faster than anything else on this page, because the systems upstream keep changing, so this is sold with monthly operation and not as a build we walk away from. Its own machine.

Search

• Search that returns the right thing, on your own machine. Meilisearch or Typesense where a site or an application has to be searchable and the corpus is human sized. OpenSearch where it is logs, or millions of documents. OpenSearch is memory hungry and easy to under-size, so it is quoted against a document count and a retention period rather than against a machine.

Every system here is open source and named in full, with its upstream project. What you buy is never the software: it is the installing, the keeping current, and being the person who is called when it breaks.

06

Run and watch.

The machines, and knowing when one of them stops.

Virtualisation and containers

• Proxmox VE, with a container where a container is enough and a virtual machine where it is not. For anyone whose hypervisor renewal quote has arrived and no longer resembles the last one. On containers we will say the unpopular thing: most estates this size do not need Kubernetes, and running one is a job somebody has to be paid for. k3s where the workload really does span machines. Moving off an existing hypervisor touches storage, networking and backup at once, so it is a project rather than an afternoon. Its own machine.

Monitoring

• Prometheus for metrics, Loki for logs, Alertmanager for what wakes somebody, Grafana over the top, VictoriaMetrics where retention has to be long. For any estate where the first sign of a problem is a person complaining. In place of a bill that grows with every host you add. Alerts are written against a runbook rather than a raw threshold, because alerts with nothing behind them teach people to ignore alerts.

Status and outside checks

• External availability checks with Uptime Kuma or Gatus, and a status page for your organisation. We agree who updates the page during an incident and which checks run automatically.

Backups

• restic or Borg for files, pgBackRest for PostgreSQL, off-site and encrypted with a key you hold. For every estate on this page, and particularly the ones that believe they already have this. What is delivered is a restore that has been performed and timed, not a schedule nobody has tested. Holding the key yourself is the trade: it means we cannot recover your data for you. The rest is on the open stack page.

Intrusion detection

• Detection and event records with CrowdSec, Suricata and Wazuh. Findings are reviewed during working hours; the scope of incident response is agreed in writing.

Every system here is open source and named in full, with its upstream project. What you buy is never the software: it is the installing, the keeping current, and being the person who is called when it breaks.

07

Run the business.

The queue, the plan, the record and the invoice.

Helpdesk

• A desk where requests arrive, get an owner and get closed. Zammad where the process is formal, FreeScout where a shared mailbox and a little discipline is honestly the answer, Chatwoot where people write from four places at once. For teams paying per agent for a queue. Cost follows the deployment, so adding an agent in December does not change the bill. Bringing existing ticket history across is engineering, and it is rarely clean.

Projects and tickets

• Somewhere the work is written down that is not a chat room. OpenProject where there is a plan and a budget, Redmine where it must be dull and last a decade, Plane where people expect a board, Vikunja where lists are honestly enough. In place of a tracker billed by the head. What does not come across from an existing tracker is the workflow and the history, and that is agreed before the move rather than discovered three months after it. Its own machine, priced by the machine.

CRM

• Your customer records, on your machine, in a form you can export at any hour. EspoCRM for a straightforward pipeline, SuiteCRM where an existing process has to be reproduced rather than reformed, Twenty where the interface matters to the people using it. For organisations whose customer list is held by a supplier and priced by the head. A CRM is only as good as the process around it, and no product on this row supplies the process. Its own machine.

Time, invoicing, booking, forms, signature and events

• The small subscriptions, in one row. Kimai for hours, Invoice Ninja for invoices, Cal.com for booking, LimeSurvey or Formbricks for forms, DocuSeal for signatures with an audit trail, Pretix or Mobilizon for events. Individually small; together a monthly bill nobody has looked at in two years. Two boundaries. None of these is bookkeeping and none of them files anything with anybody. And whether an electronic signature holds is a question for your own counsel: what we provide is the mechanism and the audit trail, not the opinion. Several of these have a commercial layer above an open core, so we state the licence per product before you pick.

Learning: Moodle

• Moodle, with live sessions in BigBlueButton and enrolment coming from the same directory as everything else. For schools, colleges, training providers and any organisation that has to prove somebody completed something. In place of a platform priced per learner where the population is large, seasonal and mostly idle. We run the system. The statutory record-keeping duty stays with the institution and does not move to us. Its own machine, priced by the machine.

Every system here is open source and named in full, with its upstream project. What you buy is never the software: it is the installing, the keeping current, and being the person who is called when it breaks.

08

Models.

Inference on hardware you hold, and everything around it.

Local inference

• Models running on hardware you hold, so the documents worth asking about never leave. Ollama where the estate is small, vLLM where throughput matters, llama.cpp where the hardware is modest, with Open WebUI or LibreChat in front so people can use it without a terminal. Local inference is not always cheaper: past a certain volume it is, below it an API is, and the machine learning page does that arithmetic honestly. Sized before priced, against the card the evaluation says you need rather than the one in the brochure.

Retrieval, transcription and the record of what was trained

• The parts around a model. pgvector where you already run PostgreSQL and do not need a second database, Qdrant where the index has outgrown that. faster-whisper for transcription on your own machine, for recordings you cannot upload anywhere. Label Studio where somebody has to label, with a written guideline and a way to settle disagreements. MLflow, so six months later there is a record of what was trained on what. Transcribing meetings and calls creates personal data with a retention obligation attached, and that is decided before the first recording rather than after.

The small tools that remove a subscription

• Stirling PDF instead of paying to merge two files. LanguageTool instead of a grammar service that reads everything you write. Immich for photographs that are records rather than memories. The rest of this run, shared bookmarks, a feed reader and short links on your own domain, is already described on the open stack page. Each removes one small bill. A long tail of small services is also a long tail of small upgrades, so what the monthly rate covers is stated per deployment rather than assumed.

Every system here is open source and named in full, with its upstream project. What you buy is never the software: it is the installing, the keeping current, and being the person who is called when it breaks.

A

The three price shapes.

Three shapes, and no number on this page is new. Every figure here already stands on the page of the work it prices.

On a deployment you already have

• Some of these ride on a machine that is already yours and already maintained, at the extra-service rate on the service-page price panels. Adding one does not add a machine, so it does not add a machine cost.

Its own machine

• Most want a machine of their own: setup once, then the monthly rate for where that machine stands. The rate is per machine and per estate, never per person, so the bill does not move when you grow.
• Matrix
• Mail
• Nextcloud / Seafile
• Keycloak
• Forgejo / GitLab CE
• PostgreSQL
• Pipelines
• Proxmox VE
• Projects and tickets
• CRM
• Moodle

Sized before priced

• A few cannot honestly be priced before they are sized, because the cost is a volume rather than a box: video transcoding, model inference, large object storage, and rescuing a mail domain that already carries years of bad practice. Those say so instead of carrying a figure that would move.
• Jitsi Meet
• BigBlueButton
• PeerTube
• Object storage
• Analytics store and reporting
• OpenSearch
• Local inference

Assessment: from 3 days at 110 EUR an hour. The price panels on /consulting, /matrix, /open-stack and /machine-learning carry the tariff and a calculator that runs in your browser.

Which shape a row takes is set against that row rather than assumed from this panel. Installing is engineering, at the published hourly rate or fixed against an assessment.

B

What we will not run.

A catalogue that says yes to everything is a catalogue nobody can weigh. These are the refusals, with the reason.

Not statutory accounting, payroll or anything that files with a tax authority. The software is the easy half and the liability is not ours to carry.

Not clinical or prescribing systems. A record store for a health or care organisation is different work and we do it; the system a clinician prescribes from is not ours to operate.

ALSO NOT

• Card data inside the scope of PCI DSS
• Work requiring a clearance or certification
• A closed component we would be asked to vouch for and not allowed to read
• Anything we would be the only copy of: if it cannot be handed over, we should not have built it

AND ONE BOUNDARY ON THE DETECTION ROW

• Intrusion detection here is detection and a record of it
• It is not a managed security service and not an endpoint product
• Response is in working hours under the terms.

The rest of what we refuse is on the consulting page and on the inquire page, and it is not repeated here.

C

Ask what your estate would cost.

Tell us what you run now and how many people use it. You get a figure from a person who has read it, not a form.

Write to

hello@ave17.com

About

Systems

Nothing is submitted from this site. The button opens your own mail program with a draft already written.

D

A selection of licences, and what each one asks.

The licence is the proof. A system you can run, read, change and leave is a system whose licence says so. This table lists a selection of the engines named on this site, with their licences.

Three families, and the difference is about running rather than about owning. A network licence asks you to offer your changes to the people using the service. A copyleft one asks nothing of an operator and asks for the source when you hand a changed copy to somebody else. A permissive one asks you to keep the notice. None of the three asks you to publish what you keep to yourself.

E

Find it by what you pay for today.

The page above is arranged by the work. This is the same rows arranged by the thing they stand in place of, because that is usually the question a reader actually arrives with.

Naming a product here says what a system stands in place of and nothing about the product itself. Several of them are good at what they do; the argument on this page is about who owns the thing and how it is priced, not about quality.

F

Where there is more than one open answer.

Four places on this page where the honest answer is that two or three open engines all do the job, and picking the wrong one is expensive in both directions. Not one proprietary product appears below: this is a comparison between things you would own either way.

Meetings or teaching?

The two most expensive things on the catalogue to run, and the pair most often confused. They do different jobs and are sized differently, and buying the wrong machine for the wrong one is expensive both ways.

Ours: if the people joining are not in your directory and the call is a conversation, the meeting engine. If somebody is teaching and the session is a lesson with a register at the end of it, the classroom. Running both is normal and is two deployments, not one with a switch.

Which sign-in?

Three open identity servers, all of which will hold your directory and speak the same protocols. The difference is in how much of it you have to operate and how far it bends.

Ours: where the estate is large and long-lived and somebody will own identity as a job, the foundation project. Where the interesting part is putting a sign-in in front of things that have none, the one with the proxy outposts. Where the estate is small and modern, the smallest of the three. All three are a real answer and none of them is a lock-in.

Which office suite beside the files?

Both edit a document in a browser, both sit beside the same file store, and both are open. They disagree about what a document is.

Ours: if the documents that matter come from outside and arrive as .docx and .xlsx, the one built for those formats will lose you fewer arguments. If the archive is yours and is meant to outlive the software, the open standard is the point. This is the one row on the page where the honest answer depends more on your correspondents than on you.

Watching the machines, or watching the service?

Two different questions that look like one until the first outage. Most estates end up running both, and the mistake is buying one machine for the pair.

Ours: run both. The outside check is what tells you there is a problem and the inside one is what tells you what it is, and an estate with only the second finds out from a customer.

Every row is either a fact you can check for yourself or a judgement of ours, and the closing line of each table is the judgement, marked as ours. These are deployment options, not a record of systems we operate.

HOW IT IS PRICED

• A · The three price shapes
• B · What we will not run

WHAT YOU CAN CHECK

• D · Every licence, and what each one asks
• E · Find it by what you pay for today
• F · Where there is more than one open answer

BEFORE YOU BUY

• C · Ask what your estate would cost