Internal zone · West Europe

ATSC-Intranet

intranet.atsc.global

Staff apps that hold HR and executive data, and a fenced-off Docker playground for developers.

What runs here

Exec Dashboards: the estate brief on cloud cost, risk, security and engineering activity
Employee Assessment Portal: self-assessment with employee and manager views
Playground: its own rootless Docker daemon for trying things out
Postgres 16, Uptime Kuma and nightly backups

6 of 196 of 19 done

Done: Server built in West Europe, with encryption at host and a separate data disk1 Oct 2026
Done: IP4X server baseline: data disk on /data, swap, capped logs, Caddy with security headers, health probe1 Oct 2026
Done: Playground user with its own rootless Docker, capped at 2 vCPU and 6 GiB1 Oct 2026
Done: Ports 80 and 443 open to the internet
Done: DNS: intranet.atsc.global points at this server
Done: HTTPS certificate for intranet.atsc.global
To do: Key Vault for this server’s secrets, read with its own identity
To do: Monitoring agent sending sign-in and sudo logs to the capped log workspace
To do: Daily Azure Backup of this server, kept for 30 days
To do: Postgres 16 on the data disk, with a nightly dump to write-once storage
To do: Exec Dashboards: managed identity instead of personal az and aws logins
To do: Exec Dashboards: Entra sign-in for the Execs group, then publish it
To do: Assessment Portal: API, database and Entra roles before any real staff data
To do: Assessment Portal: POPIA impact assessment, consent notice and retention period
To do: First app published: its Caddy site behind Entra sign-in
To do: Uptime Kuma checking every public platform hostname
To do: Fold the atsc-dev VM into the Playground once its owner confirms
To do: Defender for Servers P1 on this server
To do: Lock backup immutability after a month of tested restores