Why this exists
Most organisations of 50–500 people run their internal services on a mix of ad-hoc decisions: DNS is handled by the router, certificates are self-signed and expired, file sharing is a mix of Dropbox and shared drives, nobody knows what IP ranges are in use, and the CMDB is a spreadsheet someone stopped updating two years ago.
This is not a failure of intent — it is a failure of having the right foundation in place. Identity management cannot be centralised without reliable internal DNS. VPN certificates cannot be managed without a certificate authority. Log timestamps are worthless without synchronised time across all hosts. Patch management cannot be automated without an accurate inventory.
Without Atlas Core
With Atlas Core
Architecture
Hosting & provisioning server. Every Atlas Core service runs on a single internal server built on Proxmox VE — one host at Foundation (mini-PC class, e.g. Minisforum MS-01), an HA pair at Plus (1U rack, ECC), and a cluster at Enterprise. The same host carries the provisioning plane that builds and maintains every node: PXE/preseed for the hardened Debian 12 base, Ansible + Gitea (AWX/AAP at higher tiers), Terraform/OpenTofu, and NetBox as the source of truth. The hardware and software specification is defined per tier so the box that hosts the services also provisions them.
What's inside
Every Atlas Core box ships with these services already installed, already talking to each other, and already published behind TLS. You do not configure them — you use them. The full configuration reference and per-service runbooks are handed over with the box.
PowerDNS — internal DNS
PowerDNS + PowerDNS-Admin web GUI
Name resolution for your own network, managed in a browser. Replaces the DNS built into your router; outbound lookups leave encrypted.
ISC Kea — DHCP
ISC Kea + Stork dashboard
Hands out IP addresses per VLAN and tells every device where DNS and time come from. Live leases and pool usage on one dashboard.
PKI — certificates
step-ca · Vault PKI · EJBCA (by box)
Your own certificate authority with a web interface. Issues and renews server, user and machine certificates automatically — no OpenSSL by hand.
NetBox — inventory & IPAM
NetBox + PostgreSQL
The single record of what you own and which address it uses. Every other service and all automation reads from it.
Chrony — time synchronisation
chrony, stratum 2 (PTB Braunschweig)
Every host on the same clock, traceable to the German national time standard. Without it, log timestamps and audit trails are worthless.
NGINX Proxy Manager — reverse proxy
NGINX + web GUI
One encrypted entry point in front of every internal service, with certificates issued and renewed for you.
OpenCloud — file sync
OpenCloud
Company file sharing and sync on your own storage — a Dropbox or OneDrive replacement whose data never leaves your premises.
NetBird — management VPN
NetBird (WireGuard-based) + web GUI
Encrypted remote access with a dashboard: who may reach which system, and who connected when.
Oxidized — config backup
Oxidized + Gitea
Every router and switch configuration backed up automatically and versioned, so any change can be traced or rolled back.
Ansible / AWX — automation
Ansible CLI · AWX · AAP (by box)
Patching and recurring tasks run from one place instead of host by host. Web GUI from the Plus box upwards.
Gitea — version control
Gitea, self-hosted
Git for your configurations and automation code, hosted by you. Nothing is parked with an external provider.
HashiCorp Vault — secrets add-on
Vault OSS (Raft)
Passwords, API keys and database credentials in one audited vault instead of spreadsheets. Add-on to the Enterprise box.
Want the detailed architecture, tier diagrams or a sample runbook before you decide? Ask us for the documentation pack.
Regulatory compliance
Each control below maps to the Atlas Core component that satisfies it and the evidence it produces.
| Regulation / Control | Requirement | Atlas Core component | Evidence |
|---|---|---|---|
| NIS2 Art. 21(2)(e) | Use of secure communication channels; encryption of data in transit | step-ca — all internal TLS certs; NGINX — TLS termination | Cert inventory export from step-ca |
| NIS2 Art. 21(2)(j) | Patch and vulnerability management — maintain up-to-date software | Ansible patch management — weekly runs, documented in AWX job history | AWX job history export; before/after CVE scan |
| GDPR Art. 25 | Data protection by design — access control, encryption by default | step-ca — TLS everywhere by default; NGINX — no plaintext HTTP internally | step-ca audit log; NGINX access log review |
| GDPR Art. 32(1)(a) | Pseudonymisation and encryption of personal data | OpenCloud — server-side encryption; step-ca — key management | OpenCloud encryption config export |
| BSI OPS.1.1.3 | Patch management — documented policy, tracked application of patches | Ansible + AWX — all patch runs version-controlled in GitLab | Git history of Ansible playbooks + AWX job log |
| BSI OPS.1.2.1 | Change management — all changes documented and traceable | NetBox — change history per object (built-in journal & changelog) | NetBox changelog export |
| DORA Art. 9(2) | ICT asset inventory — complete and up-to-date register of ICT assets | NetBox — single CMDB for all network devices, IPs, and IT assets | NetBox API / report export |
| CRA Annex I §1 | Products shall be delivered without known exploitable vulnerabilities | Ansible patch management ensures all deployed components are at latest stable release | Greenbone scan post-deployment (Atlas Perimeter) |
Standalone installation
Each component can be deployed independently without committing to a full Atlas Core integration. Fill in the Customer Request Form, we scope the job, we deploy. Fixed price, fixed scope, 5-day post-install support included.
PowerDNS — standalone
PowerDNS 4.9 + PowerDNS-Admin · :53 UDP/TCP · web GUIInternal DNS with a browser interface for your organisation. Split-horizon: internal zones resolved locally, external queries forwarded over DNS-over-TLS. Zones and records managed in the PowerDNS-Admin GUI. Replaces router DNS immediately.
€ 590
Net, excl. VAT · travel included within 100km Hamburg · hardware not included
Download CRF & request quotestep-ca — Certificate Authority
smallstep/certificates · ACME · :443 HTTPSEntry-level internal CA for your organisation. Root CA generated offline, intermediate CA in step-ca. Issues certificates for internal services automatically over ACME with short TTLs. Upgradeable to the Vault PKI / EJBCA web interface below.
€ 640
Net, excl. VAT · travel included within 100km Hamburg · hardware not included
Download CRF & request quotePKI web interface — Vault PKI / EJBCA
Vault PKI + Vault UI · or EJBCA + Admin/RA GUI · server · client · M2MA managed PKI with a browser interface for the full certificate lifecycle. Vault PKI (with the Vault UI) or EJBCA (Admin + RA GUI, certificate profiles, HSM). Issues and revokes server (TLS), client (mTLS) and M2M (workload identity) certificates, with CRL/OCSP.
from € 890
Net, excl. VAT · travel included within 100km Hamburg · hardware not included
Download CRF & request quoteChrony — Time synchronisation
chrony 4.x · stratum 2 · PTB referenceStratum-2 NTP server synchronised to the German national time standard (PTB Braunschweig). Required for Kerberos, SIEM log correlation, and any compliance audit trail.
€ 240
Net, excl. VAT · travel included within 100km Hamburg · hardware not included
Download CRF & request quoteISC Kea DHCP — standalone
ISC Kea 2.6 + Stork · :67/68 UDP · web dashboardModern, API-driven DHCP with a browser dashboard. Leases addresses per VLAN and hands out DNS (option 6) and NTP (option 42) automatically. Live leases and pool utilisation in the Stork web dashboard. Replaces router DHCP cleanly.
€ 520
Net, excl. VAT · travel included within 100km Hamburg · hardware not included
Download CRF & request quoteReady-made boxes
Three boxes, three fixed prices. Each ships pre-configured and pre-hardened, with every service already installed and wired to the others. You rack it, work through a short quick-start guide, and it runs — no audit, no project phase, no consulting engagement required. Want it fitted into an environment you already run instead? Add a package from the consulting section below.
5–50 users · 1 site · single server
€ 2,450
Net, excl. VAT · one-off fixed price · hardware not included
50–500 users · 1–5 sites · HA-ready
€ 3,290
Net, excl. VAT · one-off fixed price · hardware not included
500+ users · multi-site · cluster-ready
€ 3,980
Net, excl. VAT · one-off fixed price · hardware not included
Consulting services
The boxes are built to run on their own. When you want one fitted into what you already have — or evidence for a regulator — add a fixed-price package. No open-ended day rates.
Installation & handover
We install the box in your environment, connect it to your network and DNS, and hand it over configured and documented. Remote, or on-site within 100 km of Hamburg.
€ 890
Net, excl. VAT · fixed price
Request this packageIntegration into your environment
Connecting the box to what you already run — Active Directory, an existing DNS or firewall, your monitoring or SIEM — including migration of existing data.
€ 1,890
Net, excl. VAT · fixed price
Request this packageCompliance mapping & audit support
We map the delivered configuration to NIS2, BSI IT-Grundschutz or DORA controls and hand over the evidence package your auditor will ask for.
€ 1,490
Net, excl. VAT · fixed price
Request this packageCopyright © XpertOne Security Consulting GmbH. All Rights Reserved. | Impressum | Datenschutz