Sovereign Infrastructure: Running Domillio on Your Own Server or Cloud VPS

1. The Sovereign Compliance Philosophy

Compliance data is exceptionally sensitive: state resale tax IDs, federal CPC lab certificates, supplier EORI numbers, and wholesale customer tax records. Relying on third-party SaaS vendors exposes merchants to recurring subscription inflation, vendor lock-in, and downstream data breaches.

Domillio apps are engineered with a Sovereign-First architecture: merchants retain 100% ownership of their database, audit ledgers, and certificate storage on hardware or cloud servers they completely control.

2. Server & Cloud Hosting Options

Domillio is 100% platform-agnostic. Merchants have complete freedom to choose where and how to host their compliance desks:

• Dedicated Linux Server / On-Premises Bare-Metal: Run on any standard Linux distribution (Ubuntu Server, Debian, Fedora, Arch) in your office rack or private data center for maximum privacy.

• Cloud VPS Providers: Deploy lightweight Docker containers on cost-effective cloud VPS providers like Hetzner Cloud (from €3.79/mo), DigitalOcean Droplets (from $4/mo), or Linode/Akamai Cloud.

• Managed Container Platforms: Run on modern container services such as AWS ECS / Lightsail, Google Cloud Run, Railway, Render, or Fly.io with automated scaling.

3. Multi-Container Docker Architecture

The deployment utilizes a battle-tested 3-container topology orchestrated by Docker Compose:

• domillio-tax-db: PostgreSQL 16 Alpine with isolated local volume storage and healthcheck synchronization.
• domillio-tax-app: React Router 7 / Node 22 runtime running non-root with tini init and bounded healthz probes.
• domillio-tax-tunnel: Cloudflared daemon maintaining an outbound-only encrypted WireGuard connection to Cloudflare edge.

4. Ingress Security via Cloudflare Zero Trust

Traditional self-hosting requires opening router ports (80/443) and dynamic DNS, exposing networks to automated bot attacks. Cloudflare Tunnels create an outbound-only tunnel directly to Cloudflare's global edge network. Your server firewall stays 100% closed, while Cloudflare provides free managed SSL, HTTP/2, and enterprise DDoS shielding.

5. Roadmap: In-Application Cloud Extensions

To make private cloud deployment completely effortless, Domillio's product roadmap includes native in-application cloud extensions directly inside the merchant admin.

Merchants will be able to connect their preferred cloud provider (AWS, GCP, DigitalOcean, Hetzner, Railway) via API tokens and launch or scale dedicated compliance desks with 1 click without opening a terminal.

6. Backup, Rollback & Disaster Recovery

Daily automated PostgreSQL dumps and uploads volume snapshots can be synchronized to encrypted cold storage (S3, Backblaze B2, or local storage). If host hardware ever fails, a replacement instance can be provisioned in under 15 minutes using the automated setup script.