Abstract: Self-hosting is not for everyone, and most articles on the subject present it as a binary decision that it is not. This node documents the architecture of the Sovereign Hub: 25 Docker containers on an Oracle Cloud Ampere ARM64 instance, organized into five functional layers, running consulting, automation, portal, beekeeping, and real estate operations from the Ambalá-Calambeo corridor. What component does what, why that one was chosen and not another, what it really cost to set it up, and what decisions were not obvious. Useful for independent developers and technical consultants evaluating which part of their stack makes sense to control.
The first time I migrated n8n from cloud to self-hosted was for a practical reason: the paid plan limited the number of monthly executions in a way that did not fit the flow volume of a medium client project. Self-hosting resolved the limit and brought the monthly cost down to zero for licensing.
What I did not expect was the side effect: when a flow fails in self-hosted production, the error is in my logs, on my server, under my control. There is no need to open a ticket. There is no need to wait for the provider to investigate. The failure is mine — and that, counterintuitively, is more reassuring than relying on someone else to resolve it.
From there, the stack grew in layers, each motivated by a specific problem, not by a prior philosophy of sovereignty. The current result: 25 Docker containers on an Oracle Cloud Ampere ARM64 instance, all behind an Nginx reverse proxy with SSL, all accessible by their own URL, all with zero licensing cost.
Why this moment makes sense for self-hosting
GPU prices have fallen between 40% and 60% since 2024, according to the Northflank AI Hosting Report 2026. A VPS with 16-32 GB of RAM to run an automation stack and local models costs between $20 and $50 monthly from commercial providers — or $0 in the free tier of Oracle Cloud Ampere ARM64, which offers 4 OCPUs, 24 GB of RAM, and 200 GB of storage at no cost indefinitely.
The economic breaking point against cloud APIs is around 500,000 tokens per day for mid-tier models. Above that volume, self-hosted is almost always cheaper. Below that, cloud APIs are more convenient — once maintenance hours are accounted for.
But the economic argument is not the only one. There are three variables that the token calculator does not capture:
Jurisdictional risk — any cloud service under a jurisdiction with unilateral intervention capability is a potential point of failure. The Fable 5 episode demonstrated this in 72 hours. Self-hosted components have hardware and energy risk, not regulatory risk.
Client data — in February 2026, a federal court in New York determined that confidential data processed by commercial AI platforms lose privilege protection because they do not meet confidentiality requirements. Self-hosting is the correct architectural response to that risk.
Cost predictability — SaaS APIs scale linearly with usage. A traffic spike can triple the monthly bill without warning. Self-hosted has fixed costs regardless of volume.
The base infrastructure: OCI Ampere ARM64 + Docker
The server is an Oracle Cloud Infrastructure Ampere ARM64 instance — high-performance architecture with energy-efficient consumption, available in the OCI free tier with no time limit. All services run as isolated Docker containers, allowing them to be updated, restarted, or removed without affecting the rest of the stack.
The network principle is simple: all ports are mapped to localhost (127.0.0.1) except for two services that require direct public access. The Nginx reverse proxy manages domain routing with SSL — each service has its own URL without exposing ports externally.
The five layers of the stack
Layer 1 — Portals and content
Astro v5 + Strapi v5 are the heart of the personal brand portal. Astro generates the static site with partial hydration; Strapi manages articles from the digital garden, service sheets, and leads with AI-enhanced hooks. The portal's semantic search — the Matchmaker — runs on embeddings stored in Qdrant.
WordPress runs in parallel for landing pages and secondary blogs that require quick publishing without a build cycle. It shares a MySQL database with QloApps.
Cafetería App is the menu, reservations, and interaction portal for the Café Iwagé project — an independent container to keep the deployment cycle separate from the main portal.
A real friction with Strapi v5: it consumed more RAM than anticipated on the initial server. The OCI Ampere instance with 24 GB resolved the problem at no additional cost — a concrete advantage of the free tier over a commercial VPS.
Layer 2 — Business management
Odoo Community in two independent instances: one for central CRM/ERP — clients, billing, sales pipeline, lead consolidation from the portals — and another filtered for the electronics store. Community Edition is completely open-source, with no licensing cost regardless of the number of users or modules.
QloApps PMS manages reservations, rates, and check-ins for Espacios Plus — the property management that an Airbnb or SaaS booking system would resolve with pricing per reservation. Self-hosted eliminates that commission.
Financial Model Pro is a proprietary application for investment projections in land and financial simulations for the Iwagé project — business logic too specific to trust to a generic tool or a SaaS provider that may change its terms.
Iwagé has three separate components: frontend in React for property search and visualization, backend Flask with REST API for geographic searches and synchronization with the CRM, and administrative intranet for the advisory team. Three containers, three independent deployment cycles.
Layer 3 — Artificial intelligence and agents
Open WebUI / OpenClaw is the chat interface that connects with Ollama (local models like Qwen 2.5) and cloud APIs (DeepSeek, GPT-5 Mini) in a single interface. Integrated RAG for files — drag a PDF and the model reads it without leaving the server.
Dify is the orchestration platform for autonomous agents. While n8n manages data flows between services, Dify manages reasoning flows between models — advanced RAG pipelines, agents with memory, testing flows, and prompt evaluation. The two complement each other: n8n for process automation, Dify for reasoning automation.
Qdrant is the dedicated vector database. The decision to use Qdrant over pgvector in PostgreSQL was one of specialization: pgvector is sufficient for low volumes and simple queries, but Qdrant has optimized HNSW indexes and payload filtering that Dify leverages for more precise semantic search at scale. PostgreSQL remains the relational database of the ecosystem — they are complementary layers, not alternatives.
Sostenty is the Flask application for ESG lifecycle analysis and carbon intelligence under international regulations. It runs as a public service (the only one along with the main database) because it serves external inquiries from environmental consulting clients.
Layer 4 — Collaboration and communication
Nextcloud replaces Google Drive and Dropbox for storage and collaboration. Each client has their folder with controlled access. The push engine in Rust manages real-time notifications without polling. Data does not leave the server.
Chatwoot aggregates WhatsApp Business, email, and web widget into a single console. The integration with n8n automates responses based on predefined rules and logs the history in PostgreSQL. The equivalent SaaS alternative — Intercom, Zendesk — has agent pricing that does not scale for a variable operation.
Listmonk manages newsletters and mass email campaigns. Self-hosted alternative to Mailchimp or ConvertKit — no limit on contacts, no cost per send, no risk of the provider suspending the account for content that does not comply with their policies.
Docmost centralizes internal documentation: procedure manuals, development guides, project runbooks. Alternative to Notion or Confluence — internal documents do not live on third-party servers.
NocoDB is the visual interface over PostgreSQL — Airtable-like for auditing and modifying tables without writing SQL. Useful for reviewing n8n data in production or correcting specific records without touching the database directly.
Vaultwarden is self-hosted Bitwarden in Rust. Credentials for the entire ecosystem — 25 containers, dozens of APIs, client accesses — live encrypted on the server, not on Bitwarden Inc.'s servers.
Layer 5 — Cross-cutting infrastructure
PostgreSQL with pgvector is the main database of the ecosystem: Sostenty, Odoo, n8n, and Nextcloud share the same instance with separate schemas. pgvector enables semantic search directly in PostgreSQL for cases where scale does not justify Qdrant.
MySQL runs in parallel exclusively for QloApps and WordPress — two applications that do not natively support PostgreSQL.
Redis is the cache and message queue layer shared by Nextcloud and Chatwoot. The n8n flows that process documents in batches use Redis to regulate the request rate and avoid saturating internal APIs.
Uptime Kuma monitors the health of all applications in real-time and immediately notifies when something goes down. It solves the manual monitoring problem that any self-hosted stack has if not considered from the start — and that I did not consider in the early iterations.
Form Handler is a micro-API in Node.js that processes leads from contact forms and PDF downloads: validates, stores in PostgreSQL, and sends alerts via email. Simple logic that does not justify a monthly-priced SaaS form service.
What it really costs
| Component | Monthly Cost | Notes |
|---|---|---|
| OCI Ampere ARM64 (4 OCPUs, 24GB RAM, 200GB) | $0 | Permanent free tier from Oracle Cloud |
| Main domain | ~$1.5 USD amortized | Annual renewal |
| Cloud models (DeepSeek, MiniMax, GLM) | $8–15 USD | Variable based on monthly volume |
| Claude Sonnet / Opus (specific tasks) | $5–20 USD | Only tasks that justify the cost |
| WhatsApp Business API (Meta) | $0–5 USD | First 1,000 conversations/month free |
| Total complete stack | ~$15–40 USD/month | 25 containers, all licenses at $0 |
Compared to SaaS equivalents — n8n cloud Pro, Contentful, Intercom, HubSpot Starter, Mailchimp, Notion Team, Bitwarden Teams, Salesforce Essentials — the self-hosted stack costs approximately 90–95% less per month for the same core functionalities.
The variable that does not appear in that table: maintenance time. Updating 25 containers, managing logs, resolving dependency conflicts between versions — that work exists and has a cost even if it is not monetary. The honest estimate is between 2 and 4 hours monthly for a stable stack, more time in months of major updates.
What is not resolved
Automatic failover for AI models does not exist yet. If DeepSeek Flash does not respond, the n8n flow fails instead of redirecting to Ollama automatically. That requires an orchestration layer that is pending — and when implemented, will update this node.
Latency from Colombia to the OCI datacenter is real — between 150 and 220ms depending on the time of day. For synchronous flows where the user expects an immediate response, that is noticeable. For asynchronous flows with results via webhook, it does not matter.
And the stack on ARM64 has a concrete restriction: some Docker containers do not have a native ARM64 image and require emulation or compilation from source. Hermes Desktop, for example, is incompatible with ARM64 — the alternative is the CLI path via cloud APIs, which is what I use.
The three principles that order the architecture
The digital garden as the nervous system — the portal is not a static CV. Each published node interconnects with real projects and active services. Content and operation are the same thing.
Client portals as trusted infrastructure — each client has their folder in Nextcloud and their view in NocoDB. Real-time tracking does not live in a PDF sent by email — it lives in a system that the client can consult directly.
Networks as antennas, not as destinations — social networks redirect traffic to the sovereign portal. The experience, data, and relationship with the visitor occur where I control the infrastructure, not where another platform's algorithm decides what to show.
If you are evaluating which part of your stack makes sense to control, the most useful question is not "Can I self-host this?" but "What happens to my operation if this service changes its terms, raises its prices, or becomes unavailable tomorrow?" The answer defines what is worth the complexity of self-hosting and what is not.
Sources cited in this node:
- Northflank AI Hosting Report 2026 — GPU price drop 40–60%
- AI Cost Check — break-even self-hosting: ~500K tokens/day for mid-tier models, March 2026
- SDNY ruling February 2026 — confidential data on cloud platforms and loss of legal privilege
- Oracle Cloud Free Tier — Ampere ARM64 specifications, June 2026
- Internal catalog Sovereign Hub — applications_server.md, June 2026