Secure Distributed Project and Information Vault

The challenge

Project information needed to remain available across devices without becoming dependent on a single workstation or a consumer file-sharing account. The solution also needed to support private deployment, secure enrollment, granular access, and growth from one server into a distributed service environment.

The organization required control of its own data and infrastructure — not a SaaS product that could change terms, pricing, or availability without notice.

Requirements

• Centralize authoritative project information while preserving useful local access
• Support secure client enrollment, authentication, and permission-aware synchronization
• Allow services to run together initially and separate across nodes as requirements grow
• Continue useful work through intermittent connectivity and recover cleanly after reconnection
• Provide maintainable installation, upgrades, health reporting, and repair paths

Architecture

We designed a server-client topology with a private control plane for identity, enrollment, configuration, and service discovery. Independent nodes advertise capabilities such as identity, file storage, backup, synchronization, or general compute. Clients maintain appropriate local state and exchange signed, permission-checked updates with authorized services.

┌─────────────┐     ┌──────────────────────────────────┐
│ Clients     │────▶│ Identity · enrollment · sync     │
│ (desktop /  │     └──────────────┬───────────────────┘
│  mobile)    │                    │
└─────────────┘                    ▼
                    ┌──────────────────────────────────┐
                    │ Control plane · service discovery │
                    └──────────────┬───────────────────┘
         ┌─────────────────────────┼─────────────────────────┐
         ▼                         ▼                         ▼
   ┌───────────┐            ┌─────────────┐           ┌────────────┐
   │ Identity  │            │ File / meta │           │ Backup ·   │
   │ node      │            │ storage     │           │ sync nodes │
   └───────────┘            └─────────────┘           └────────────┘

Major capabilities

• Central identity and authentication
• Secure node and client enrollment
• Project/file storage and metadata
• Synchronization and conflict-aware updates
• Role and project permissions
• Capability discovery and health reporting
• Package installation, upgrades, repair, and database migrations
• Policy distribution and service configuration
• Backup and recovery support

Security and privacy

Trust is established through deliberate enrollment rather than discovery alone. Authentication and signed requests protect node communication. Secrets are stored and transported separately from routine configuration. Permissions are checked at the service boundary, and independently deployable roles reduce the need to give every server access to every dataset.

Implementation

The project began with a single-node usable core, then added signed heartbeat communication, enrollment, service capabilities, migrations, package handling, policies, and multi-node joining. Install and upgrade paths were treated as product features because a private platform is only useful if it can be deployed and repaired reliably.

Difficult problems solved

• Making first-node installation simple without baking in a single-server architecture
• Handling identity, enrollment, and service discovery without creating circular dependencies
• Designing synchronization for real networks where clients disappear, reconnect, and submit delayed work
• Keeping upgrades idempotent across environments that may be at different schema or package versions

Operational results