Next Workspace - Self-hosted workspace platform

Find a file

cclohmar 9f6c85ce60 v0.1.0.0033: update AGENT.md/README.md/CHANGELOG with final architecture docs		2026-07-11 09:20:29 +01:00
compose	rootless podman: ports 8080/8443, iptables redirect 80→8080 443→8443, no sudo for podman	2026-07-11 00:38:24 +01:00
config	add storage.encryption_key to Authelia config, fix certs directory	2026-07-11 09:08:31 +01:00
lng	feat: global settings, multi-language (en/de), company branding on launcher + www	2026-07-08 15:32:17 +01:00
tools	fix bcrypt hash corruption: avoid bash -c re-expanding $ signs, auto-regenerate hash on update	2026-07-11 09:16:14 +01:00
.gitignore	fix .gitignore: scope nextworkspace to root to not ignore config/nextworkspace/	2026-07-11 08:54:56 +01:00
AGENT.md	v0.1.0.0033: update AGENT.md/README.md/CHANGELOG with final architecture docs	2026-07-11 09:20:29 +01:00
CHANGELOG.md	v0.1.0.0033: update AGENT.md/README.md/CHANGELOG with final architecture docs	2026-07-11 09:20:29 +01:00
go.mod	feat: Caddy + Authelia replace Zoraxy	2026-07-08 09:54:39 +01:00
go.sum	feat: Caddy + Authelia replace Zoraxy	2026-07-08 09:54:39 +01:00
main.go	fix launcher health check: install curl in alpine, update script + applySettings path	2026-07-11 00:28:44 +01:00
README.md	v0.1.0.0033: update AGENT.md/README.md/CHANGELOG with final architecture docs	2026-07-11 09:20:29 +01:00
VERSION	v0.1.0.0033: update AGENT.md/README.md/CHANGELOG with final architecture docs	2026-07-11 09:20:29 +01:00

README.md

NextWorkspace

A self-hosted productivity suite for startups. One binary + Caddy + Authelia.

Architecture

Internet :443 ──iptables──> :8443 ──> Caddy container :443
Internet :80  ──iptables──> :8080 ──> Caddy container :80

Caddy (rootless podman, nextwks-net)
  ├── auth.{DOMAIN}  ──> Authelia :9091 (internal)
  ├── app.{DOMAIN}   ──> Launcher :9000 (forward auth via Authelia)
  └── www.{DOMAIN}   ──> static files

Authelia :9091 ──> api :8080 (internal)
Launcher :9000 ──> /config, /people, /settings, /health

Caddy: TLS termination (ZeroSSL/LE), subdomain routing, forward auth to Authelia
Authelia: OIDC provider, 2FA, identity store, user management API
Launcher: Go binary — app dashboard, people directory, admin panel, settings
iptables: Redirects 80→8080 and 443→8443 so Caddy can run rootless

Quick Start (Bare VM)

# Download the script to your home folder
curl -o ~/nextwks.sh https://git.lohmar.co.uk/lexton-it/NextWks/raw/branch/main/tools/nextwks.sh
chmod +x ~/nextwks.sh

# Run the installer (no sudo — it'll ask only where needed)
./nextwks.sh --install

Prompts for domain, TLS email, and admin credentials. Installs deps (Go, Podman, git), clones repo to /tmp/nextwks-build/, builds binary, generates configs, deploys stack. The script stays in ~/nextwks.sh for future updates.

Directory Layout

/opt/nextworkspace/            # Runtime (freshly populated on every deploy)
├── config/
│   ├── caddy/Caddyfile
│   ├── authelia/configuration.yml
│   ├── authelia/users_database.yml
│   └── nextworkspace/{config,apps}.yaml
├── data/
│   ├── caddy/ (certs + runtime)
│   └── authelia/ (database)
├── compose/stack.yaml
├── www/ (landing page)
├── lng/ (translations)
└── nextworkspace (static Go binary)

/opt/backup/                   # Secrets vault (survives --destroy)
├── .env
└── certificates/

/tmp/nextwks-build/            # Ephemeral build dir (git clone --depth 1)

Operations

# Smart update (pull, build, copy, restart)
./nextwks.sh --update

# Full redeploy (tear down, rebuild from scratch with saved secrets)
./nextwks.sh --destroy

Workflow (Development)

Edit code in your clone.
Bump VERSION, update CHANGELOG.md.
git commit -m "message" && git tag v$(cat VERSION) && git push origin main --tags
On the server: ./nextwks.sh --update

The script clones fresh from git every time — no stale repos, no permissions issues.

Version

Current: 0.1.0.0032 — see CHANGELOG.md