One machine, and it does not have to be much of one.
Officer is one server process with a handful of small ones beside it — one per feature: the mailbox, the vault, the wallet, music, torrents, the agent. They run as peers under a process manager rather than as one monolith, which means a feature you never turned on is not a greyed-out button in a menu somewhere. Its process is not running, and the route it would have answered does not answer. What you installed is what you have.
A mini-PC under a desk. An old laptop with the lid shut. A box in a cupboard. Or a plain VPS from whoever you like, on the cheapest tier that comes with a disk. It is one Linux machine — Debian, Ubuntu, Arch, or a Mac if that is what is spare — and there is no cluster, no orchestrator, and no second machine that has to be awake for the first one to work. If you can keep one computer switched on, you can run the whole suite.
Almost nothing here is a server we wrote. Each app is an interface that belongs to the platform sitting in front of a proven open-source project, running untouched in a container on the same machine — and where there was no project to sit in front of, the page says so rather than blurring it.
Bridges to Vaultwarden
A client that speaks the Bitwarden protocol, plus the fill provider on the phone. The vault itself is Vaultwarden in a container, exactly as it ships.
Bridges to Headscale
Our client speaks the same protocol as any other, pointed at Headscale — unmodified — coordinating a network that is yours. It is the one piece that cannot live on this machine; see below.
Bridges to Transmission
The daemon does what it has always done. What we wrote is an interface that belongs to the platform and a backend that relays to it.
Bridges to slskd
The same shape. slskd does the networking in its own container; ours is the app in front of it.
Bridges to InvoiceShelf
InvoiceShelf holds the books. We read and write them through its own API, so the totals on the phone are the totals it has.
Bridges to Claude Code, opencode
The agents run as themselves, in your real directories. We carry the session to the phone rather than wrapping it in something of our own.
Ours, over your IMAP and SMTP
No service of ours behind it. The client is ours end to end — loosely modelled on Gmail — and underneath it is plain IMAP and SMTP with the account details you configure. One account today; several are coming.
Ours, over your files, and FFmpeg
Ours too, for want of anything to bridge to — but not invented from nothing. It stands on the shoulders of Jellyfin and Finamp, which worked out what a self-hosted library and a phone client should feel like long before this existed. It reads your disk; FFmpeg transcodes.
This is deliberate and it is the part worth checking. A suite that claimed to have rewritten a password server, a VPN control plane and a BitTorrent daemon would be asking for a kind of trust nobody should extend. These are the same projects you would install yourself, doing the same job, with your data in their formats. What we built is the part you touch.
All of it is open source — the server, every sidecar, and all the mobile apps. Read it, change it, run it, fork it, take it apart, and build on it for yourself as far as you like. The one limit is commercial: you cannot take this source, rebrand it, and sell it back to the world as a competing product. Everything short of that is yours to do — there is no tier, no locked feature and nothing held back, because there is nothing to hold it back for.
Both are ordinary choices and the suite does not care which you make. They protect you from different people, though, and that is worth being straight about.
The disk is in your building. Nobody images it without first coming through your door, and the nuclear phrase leaves whoever does arrive holding a powered-off box that wants a root password. You pay for that in the ordinary way: your electricity, your internet connection, your problem when the power goes out.
Somebody else's power and somebody else's fibre, which is the whole appeal, and there is an honest trade underneath it. A host with physical access to a disk is a host that can in principle read it. Officer on a VPS protects you from the internet; it does not protect you from the company you rented the machine from. Which of those two you are actually worried about is the question that picks your hardware — and it is a real question, with a defensible answer either way.
Everything the server does is configurable from a web interface it serves itself. The same applications you have on the phone are in the browser too, arranged the way you arrange them, and the admin controls are among them rather than hidden in a separate panel — it is closer to using an operating system than to configuring a service. Put it behind the mesh, or do not: some people will want it reachable only on the tailnet and some will not, and that is a setting rather than a position this project takes.
One administrator, and that is a decision rather than an omission. The platform was originally designed multi-user, with companies in mind; per-user sandboxes for terminals and home directories cost far more than they returned, so that was dropped rather than half-built. What replaced it is narrower and stronger. The web interface answers to a single super-admin — you. Individual apps can then carry their own users: Music does, so accounts you create in the database can sign in and stream, and for them the platform answers authentication and music and nothing else. Every other route is not theirs to call. Other apps will follow that same shape.
Start from a fresh host and run the setup script once. It works out whether it is talking to apt, pacman or brew and installs what is missing — the runtime, the build tools, the process manager — then the process manager keeps everything alive across reboots and power cuts. You will meet a terminal. This is a server, and pretending otherwise would be the first lie on the page. But you will not be pointing a DNS record at your house, opening a port on your router, or explaining a certificate to anybody.
Point it at whatever you have. For most people the machine's own SSD is the entire answer. Keep a film and music library and an external array hangs off the same box instead, with the apps none the wiser about which disk they are reading. There is no layout the platform imposes and no volume it insists on owning — how your data sits on your disks is a decision it leaves to you, because it is one where nobody else's default fits.
It depends entirely on what you intend to do with it, and a cheap machine covers most of it. Mail, passwords, the vault, invoices, the wallet, the agent — none of that is demanding. What raises the bar is media: streaming video, transcoding libraries, heavy FFmpeg work wants real cores and a real disk. Start from what you already have; the suite will tell you soon enough if you have asked too much of it.
A feature is a process, and the environment file decides which ones start. Run the mailbox and the vault and nothing else, if that is all you want — the rest are not disabled, they are absent. The apps handle that gracefully because it is a state the platform is built around rather than an error it recovers from: ask for something that is not running and you get a clean answer saying so, not a spinner that never stops.
Nothing about the server is published. No public hostname, no open port, no certificate for the outside world to check. Your devices reach it across the private mesh and that mesh is the perimeter — something sweeping the internet for machines to try finds nothing to knock on, because on the public internet there is nothing there. There is exactly one exception, and it is the card that follows.
A coordination server has to be reachable, because reaching it is the whole job: it is how two devices that have never met find each other. So Headscale is the one piece that cannot sit on your machine behind the mesh — it needs a small VPS with a public address, and very little else. Worth being precise about what that means, since it is the only public thing here: it holds keys and device names and nothing at all of yours. No files, no mail, no wallet, no vault. Run one yourself, or take hosting for it from us if a second machine is a nuisance. Better to read this now than to meet it halfway through a setup.
Not settled, and this page will keep saying so until it is. The server is moving to Docker, and the intent is the ordinary arrangement everyone already knows: the web interface shows the version you are running against the version available and tells you when they differ, very possibly updating in place from there. Written down as a plan, not as a feature.