Infinito.Nexus Blog

Stories and Updates from the Infinite Nexus

Blog

  • Infinito.Nexus 16.0: Your Servers, Privately Connected, with WireGuard Meshes Built In

    Infinito.Nexus 16.0: Your Servers, Privately Connected, with WireGuard Meshes Built In

    Release 16.0

    Infinito.Nexus 16.0 connects your servers to each other over a private, encrypted network. The new WireGuard integration (beta) sets up secure links between all servers of a deployment, checks that they work before anything relies on them and keeps every key in your own hands. Whether you run a Docker Swarm cluster or several independent servers, the traffic between them now stays private.

    The release also brings Moodle 5.3, new major versions of Mattermost, OnlyOffice, n8n and Gitea, updates to 43 applications and 33 fixes.

    🚨 16.0 is a major release. Some existing setups need attention when they upgrade, above all Moodle and Zammad. Read Before You Upgrade before you deploy.

    Private by Default

    Your servers talk to each other through encrypted connections, so internal traffic never crosses an open network.

    Keys Without the Busywork

    Keys and connections for every server are created in one step and stored safely with your configuration.

    Checked Before Use

    Every deployment confirms that each connection works before your applications depend on it.

    A Private Network Between Your Servers

    When a deployment spans several servers, they constantly exchange data: cluster coordination, shared storage and backups. With 16.0, Infinito.Nexus can send all of this through private WireGuard connections, encrypted from one server to the next.

    It adapts to the way you run your servers:

    • Clusters: in a Docker Swarm cluster, the manager acts as the central hub that connects every server.
    • Independent servers: servers without a cluster connect directly to each other, with no hub in between.
    • Separate networks: cluster traffic and storage traffic can each run on a private network of their own.
    • Your admin machine: the computer you deploy from can join the private network too.

    Shared storage follows automatically: cluster servers now reach their shared files through the private network.

    Secure Keys, Created for You

    Every server needs its own keys and has to know its neighbors. Infinito.Nexus creates all of it in a single step and stores it with your configuration. Each private key is encrypted and kept for exactly one server.

    Running that step again changes nothing. When it is time for new keys, one run replaces the keys of the whole network at once, so no server is left behind with an old one.

    Checked Before Anything Depends on It

    A connection that exists is not yet a connection that works. Every deployment tests the private network first and stops if something is wrong:

    • Every server answers: each connection must complete a secure handshake with its partners.
    • Large data gets through: a full-size packet must cross every connection without being split.
    • Tested end to end: automated tests confirm that connected servers reach each other and move data intact, while servers outside a network are refused.

    Also New in 16.0

    Moodle moves to 5.3 and upgrades existing sites during the deployment. In Nextcloud, BPM Files, News and Recognize become optional add-ons, so you install only what you actually use.

    PHP applications, PostgreSQL and Snipe-IT now size their memory to fit the container they run in, and every pinned version records where its updates come from, so each update stays traceable.

    Before You Upgrade

    Version 16.0.1 is the first published 16.0 release. Check this list before you deploy:

    If you… Then…
    Run Moodle Existing sites are upgraded to 5.3 automatically. Plugins installed through Moodle’s web interface are not carried over and need to be installed again.
    Run Zammad Zammad rebuilds its search index once, on the first deployment after the upgrade.
    Run n8n n8n moves to version 2. Single sign-on and the built-in integrations are updated for it.
    Run Nextcloud Nextcloud stays on version 34 until its OpenProject integration supports version 35.
    Want the private network WireGuard is in beta. Make sure your servers can reach each other on the WireGuard port before you switch it on.

    More Reliable

    • Sign-in settings stay intact: Keycloak changes that run at the same time no longer block each other.
    • SuiteCRM scales out: several SuiteCRM instances now share their user sessions.
    • Mail keeps trying: a mail connection that drops right at the start is retried.
    • Monitoring sees every app: health checks now test each application on its own address.

    Updated Applications

    Moodle 5.3.0 Mattermost 12.0.0 OnlyOffice 10.0.0 n8n 2.44.3 Gitea 28.1.0 GitLab 19.5.0 Keycloak 26.8.1 Synapse 1.163.0 Element 1.12.32 ERPNext 16.51.1 OpenTalk 26.2.1 Stalwart 0.16.26 WordPress 7.1.3

    Your Servers, Privately Connected

    Infrastructure is only as private as the network between its servers. With 16.0, Infinito.Nexus treats it that way: encrypted links between your hosts, set up and proven on every deployment.

    Full 16.0.1 Changelog GitHub Repository Contact Infinito.Nexus Team

    Fediverse Reactions
  • Infinito.Nexus 15.0: Your Own Mail Server, with Calendars, Contacts and Single Sign-On Built In

    Infinito.Nexus 15.0: Your Own Mail Server, with Calendars, Contacts and Single Sign-On Built In

    Release 15.0

    Infinito.Nexus 15.0 gives every deployment a modern mail server of its own. Stalwart is now the default mail provider: one server that handles email, calendars and contacts, with webmail, spam and virus filtering, signed outgoing mail and single sign-on through Keycloak. Infinito.Nexus sets all of it up for you on every deployment, on a single server or a Docker Swarm cluster.

    The release also delivers email to and from the Tor network, moves the shared database to PostgreSQL 18 and brings new major versions of MariaDB, Odoo and XWiki.

    🚨 15.0 is a major release. Some existing setups need changes before they work again, above all for mail and PostgreSQL. Read Before You Upgrade before you deploy.

    One Communication Server

    Stalwart takes over email, calendars and contacts in a single server. Works natively with Thunderbird, Outlook, Apple Mail, JMAP, CalDAV, CardDAV and WebDAV.

    Sign In Once

    Connected directly to Keycloak. Log in to Roundcube webmail and admin settings with the same account you use for every other Infinito.Nexus application.

    A Cleaner, Safer Inbox

    Built-in spam filtering and ClamAV virus scanning check every incoming message. Outgoing mail is automatically signed with DKIM, SPF and DMARC.

    One Server for Mail, Calendars and Contacts

    Until now, Infinito.Nexus ran email on Mailu, a stack of several containers, with calendars and contacts in yet another service. With 15.0, Stalwart takes over all of it in one server.

    Stalwart speaks every protocol your mail and calendar apps expect:

    • Email over SMTP, IMAP and POP3, so Thunderbird, Outlook, Apple Mail and phone mail apps work as usual.
    • JMAP, the modern, faster successor to IMAP for clients that support it.
    • Server-side filters that sort your mail before it reaches you using ManageSieve.
    • Calendars and contacts over CalDAV and CardDAV, plus file storage over WebDAV.

    Calendar and contact apps find the server on their own: point them at mail.<your-domain> and sign in with your mail account. No extra service is needed.

    In the browser, Roundcube webmail waits at webmail.<your-domain>, and administrators manage the server through Stalwart’s own web admin interface.

    Set Up for You, on Every Deployment

    You do not configure Stalwart by hand. On every deployment, Infinito.Nexus creates your domains and accounts, installs TLS certificates, connects Keycloak, generates DKIM keys and publishes the matching DNS records. This works the same way on a single server and on a Docker Swarm cluster.

    Your applications pick up the new mail server automatically. Password resets, invitations and notifications from Nextcloud, GitLab, Mastodon and the other apps go out through Stalwart without any change on your side.

    Email on the Tor Network

    Infinito.Nexus can already make your applications reachable as onion services on the Tor network. With 15.0, email follows:

    • Send mail to onion addresses: A new Tor mail gateway delivers messages for .onion recipients over Tor.
    • Notifications that arrive: 27 applications now reach the mail server over its onion address. Automated tests verify that password-reset messages arrive correctly.

    Moving from Mailu

    Mailu is now deprecated. Existing Mailu installations keep working until Mailu is removed in a future release, but new deployments should not start with it.

    Moving your mailboxes is built in. Deploy Stalwart next to Mailu and switch on the import. Infinito.Nexus then copies every account’s mail from Mailu into Stalwart while keeping folders, read and flagged states and original dates.

    Before You Upgrade

    15.0 contains breaking changes. Check this list before you deploy:

    If you… Then…
    Want to stay on Mailu for now Set MAIL_PROVIDER: web-app-mailu in your inventory.
    Want to move to Stalwart Follow the Moving from Mailu instructions above.
    Run PostgreSQL Existing PostgreSQL 17 databases are not migrated automatically. Dump them before deployment and restore them into PostgreSQL 18.
    Run Odoo Odoo moves from 19 to 20. Back up the database before deployment.
    Run MariaDB MariaDB moves from 12.3 to 13.0 and upgrades itself on first start.
    Run XWiki or OpenLDAP Back up before deploying the new versions.

    More Reliable

    • GitLab updates no longer fail: PostgreSQL now allows enough locks for GitLab migrations to finish.
    • Backups no longer abort on busy files: backups now take a clean copy after stopping the container.

    Updated Applications

    Keycloak 26.8.0 GitLab 19.4.1 Synapse 1.162.0 Element 1.12.30 Odoo 20.0 XWiki 18.8.0 ERPNext 16.37.0 Discourse 2026.9.0 Matomo 5.14.0 PeerTube 8.3.1 Snipe-IT 8.8.0 EspoCRM 10.0.9 Joomla 6.1.4

    Your Mail, Under Your Control

    Email is still the backbone of how organizations work. With 15.0, Infinito.Nexus treats it that way: a complete modern mail, calendar and contact server deployed on your own infrastructure.

    Full 15.0.0 Changelog GitHub Repository Contact Infinito.Nexus Team
    Fediverse Reactions

  • Infinito.Nexus 14.2: OpenBao introduces advanced secrets management

    Infinito.Nexus 14.2 introduces OpenBao for secrets management, giving applications and services a dedicated way to handle credentials, API keys and machine identities.

    OpenBao integrates with the existing Infinito.Nexus identity and deployment model. Users can authenticate through Keycloak, or LDAP when OpenLDAP is deployed, while services and automation use their own AppRole identities. Credentials are automatically changed on every deployment, and the OpenBao root token is not retained after the initial setup.

    The release also adds recovery handling, automatic unsealing after restarts, optional internal PKI and Prometheus alerts when OpenBao is sealed or unreachable.

    In addition, 14.2 fixes LDAP administration in LAM, improves Docker Swarm handling of existing networks, adds role-local Prometheus alert rules, restores video recording for manually created Playwright contexts and updates pgAdmin to 9.18.

    (more…)
    Fediverse Reactions
  • Infinito.Nexus 14.0: Turn Local AI into a Secure Digital Workforce

    Infinito.Nexus 14.0: Turn Local AI into a Secure Digital Workforce

    In Short

    Infinito.Nexus 14.0 enables companies to operate AI on their own infrastructure, connect it securely to existing business applications and deploy AI agents such as Hermes and OpenClaw as virtual employees. Sensitive information can be processed by local models, while optional connections to OpenAI, Anthropic and OpenRouter provide access to external frontier models when greater capabilities are needed. Companies decide which data may leave their infrastructure, which tools an agent can use and which actions remain restricted.

    Infinito.Nexus 14.0 brings models, enterprise applications and autonomous agents together in one controlled infrastructure. Organizations can now combine local AI for sensitive data with external frontier models and deploy agents such as Hermes and OpenClaw as isolated virtual employees.

    Generative AI has already changed how employees search, write, analyze and develop. But most organizations still face an uncomfortable choice: either send business data to an external AI provider or accept the operational complexity of building a local AI platform from scratch.

    Infinito.Nexus 14.0 introduces a third option: a hybrid AI architecture in which organizations decide where every workload runs.

    Sensitive prompts can be processed by local models through Ollama or LM Studio. Tasks that require the capabilities of frontier models can be routed to OpenAI, Anthropic or OpenRouter. Applications and agents use one centrally managed gateway instead of implementing separate provider integrations.

    The result is not merely another enterprise chatbot. Version 14.0 provides the foundation for a secure digital workforce.

    (more…)
    Fediverse Reactions
  • Infinito.Nexus 13.0: A Sovereign Cloud on Clearnet or Tor

    Infinito.Nexus 13.0: A Sovereign Cloud on Clearnet or Tor

    Infinito.Nexus 13.0 introduces a new choice in how organizations can operate their digital infrastructure.

    Until now, an Infinito.Nexus environment was primarily organized around public or private clearnet domains. Version 13.0 adds Tor onion services as a first-class deployment option. An organization can now build its application landscape on the conventional Internet, through Tor, or through a combination of both.

    This release includes:

    • Tor as a first-class deployment axis
    • Stable onion addresses generated during provisioning
    • Tor-aware identity and Single Sign-On flows
    • Optional parallel clearnet domains
    • Cross-domain and cross-protocol SSO improvements
    • Recovery tests based on real database dumps
    • Mandatory health probes across containerized services
    • Broader automated testing across Python, JavaScript, PHP and Ruby
    • A consolidated and more secure CI deployment chain

    Together, these changes extend digital sovereignty beyond the question of who operates the servers. Infinito.Nexus 13.0 also begins addressing where services can be reached, which network infrastructure they depend on and how much an organization must disclose merely to exist online.

    (more…)
    Fediverse Reactions
  • Infinito.Nexus 12.0: From a Single Server to a Scalable Sovereign Cloud

    Infinito.Nexus 12.0: From a Single Server to a Scalable Sovereign Cloud

    Infinito.Nexus 12.0 is one of the most significant releases in the project’s history.

    Until now, Infinito.Nexus focused primarily on automating complete open-source environments on a single Docker Compose host. Version 12.0 introduces Docker Swarm as a second deployment mode, enabling applications to run across multiple servers, scale horizontally and recover from node failures.

    This release combines capabilities that are rarely delivered by one automation platform:

    • More than 75 automatically deployable open-source applications
    • One Single Sign-On experience backed by a unified user database
    • Horizontal scaling across multiple cloud servers
    • Automated backup and continuously tested disaster recovery
    • Support across Debian, Arch Linux and RHEL-family distributions
    • Filesystem-independent operation across ext4, btrfs and ZFS

    Together, these changes transform Infinito.Nexus from an application installer into a comprehensive foundation for scalable, sovereign cloud infrastructure.

    (more…)
    Fediverse Reactions

  • WHERE OTHERS LOSE CONTROL – WE STAY IN THE LOOP.

    At Infinito.Nexus, we believe that AI should never replace human judgment.

    We are the captains. AI is our navigator.

    While others hand over responsibility to black-box systems, we stay in control. We design the architecture, review the code, verify every deployment, and make the decisions that shape the future of the systems we build.

    AI is one of the most powerful tools ever created. But it remains a tool.

    We are the engineers, architects, and craftsmen who use it to build sovereign digital infrastructure faster, more reliably, and at a scale that was impossible only a few years ago.

    (more…)
    Fediverse Reactions
  • Souveräne Enterprise KI in Tagen statt Monaten mit Infinito.Nexus

    Souveräne Enterprise KI in Tagen statt Monaten mit Infinito.Nexus

    Der gezeigte Post steht exemplarisch für eine Entwicklung, die aktuell in vielen Unternehmen zu beobachten ist. Es werden kurzfristig KI Entwicklerinnen und Entwickler gesucht, die ein breites Spektrum abdecken, von LLM Integration über RAG bis hin zu produktiven Pipelines und skalierbaren Cloud und Container Umgebungen. Der Bedarf ist hoch, die Anforderungen komplex und die Zeitfenster meist sehr eng.

    Dabei zeigt sich immer wieder, dass die eigentliche Herausforderung nicht nur im Finden einzelner Expertinnen und Experten liegt, sondern in der fehlenden technischen Grundlage, um solche Lösungen schnell, sicher und nachhaltig umzusetzen.

    (more…)
    Fediverse Reactions
  • Digitale Souveränität jetzt sichern

    Digitale Souveränität jetzt sichern

    Digitale Souveränität ist längst keine theoretische Debatte mehr, sondern eine strategische Notwendigkeit. Was sich aktuell abzeichnet, ist nicht nur ein technologischer Wandel, sondern eine geopolitische Verschiebung, die direkten Einfluss auf europäische Unternehmen hat.

    Die Diskussion in der Schweiz über ein faktisches Cloud-Verbot für sensible Daten zeigt, wie ernst die Lage inzwischen eingeschätzt wird. Gleichzeitig geraten große Anbieter wie Microsoft zunehmend unter Druck durch wettbewerbsrechtliche Prüfungen. Sicherheitsvorfälle wie das Datenleck im Schweizer Außendepartement verdeutlichen zusätzlich, wie verwundbar zentrale Systeme sind.

    Auch politisch verschärft sich die Lage. Frankreich denkt offen darüber nach, sich von US-Technologien wie Windows zu lösen. Der Hintergrund ist klar. Digitale Infrastruktur ist längst Teil geopolitischer Macht.

    (more…)
    Fediverse Reactions
  • Infinito.Nexus vs. YunoHost

    Infinito.Nexus vs. YunoHost

    Similar Vision, Different Architectural Layer

    When people first hear about Infinito.Nexus, a common question is:

    “Isn’t this basically like YunoHost?”

    It’s a fair question.

    Both projects support digital sovereignty.
    Both are open source.
    Both aim to reduce dependency on Big Tech platforms.

    But they operate at fundamentally different architectural layers.

    The Core Difference

    The most important distinction:

    Infinito.Nexus is not an operating system.

    YunoHost behaves like a server distribution — a tightly integrated system environment that packages applications into a controlled OS base.

    Infinito.Nexus, by contrast, is a provisioning and orchestration framework.

    It does not replace the operating system.
    It provisions and orchestrates infrastructure on top of it.

    This architectural choice makes Infinito.Nexus significantly more scalable and flexible.

    Instead of being tied to a specific system base, it operates across environments — allowing infrastructure to grow without requiring replatforming.

    (more…)
    Fediverse Reactions