loch.sh
FR EN
Book a call

Open-source Docker infra for web agencies and startups

Your Docker infra. Turnkey, and yours.

A documented, production-ready stack built on Docker Compose, GitLab CI and Traefik. Clone it, adapt it, deploy it — then reuse it on every project.

Let’s talk Explore the modules

In production at 3 web agencies — around 400 sites

~ % git init && git add .
~ % git commit -m "feat: first deploy"
[main (root-commit) 3f2a9c1] feat: first deploy
~ % glab repo create my-project --private
✓ Created repository my-agency/my-project
~ % loch db create mariadb my-project
✓ Created mariadb database my-project · user & password generated
~ % cat api.env
APP_ENV=prod
DATABASE_URL=mysql://my-project:••••••••@mariadb:3306/my-project
MAILER_DSN=smtp://••••••••@mail:587
~ % glab variable set API_ENV --type file --scope staging < api.env
✓ Created variable API_ENV (file · env: staging)
~ % git push -u origin main
→ pipeline #482 · build · scan · deploy
docker build -t registry.my-agency.dev/my-project/api .
✓ pushed to private registry
✓ deployed · TLS ok · backups scheduled
~ % loch ns my-deployment
✓ Switched to namespace my-deployment
~ % loch ps
NAME IMAGE STATE STATUS
───────── ───────────────────────────────────── ─────── ────────────────────
api registry.my-agency.dev/my-project/api running Up 2 min
app registry.my-agency.dev/my-project/app running Up 2 min
messenger registry.my-agency.dev/my-project/api running Up 2 min
gotenberg gotenberg/gotenberg:8 running Up 2 min
migrator registry.my-agency.dev/my-project/api exited Exited (0) 1 min ago
~ % loch shell api
root@api:/app#
Don’t panic, there’s a web interface too ;)
Built on
  • Docker Compose
  • GitLab
  • GitHub Actions
  • Traefik
  • Grafana
  • WireGuard

The problem

Every project, the same question.

A web agency shipping custom Symfony, or a startup with a single product: who takes care of hosting, the pipeline, certificates and backups?

Usually, nobody wants to. loch.sh answers it once, for all your projects.

Why “loch”

You don’t need an ocean liner to cross a lake.

A loch is a small lake. loch.sh sails in as a naval group: your stack, escorted by its GitLab runner, its monitoring, its Traefik shield, its backups and its private registry. And you command the whole fleet from a simple laptop with the loch CLI.

k8s CLOUD Act FISA 702 Patriot Act LB LB LB etcd helm ingress mesh CRD operator border protection $ loch ✓ fleet ok traefik gitlab-runner grafana backup registry loch.sh

Already in production

Not a prototype.

Every building block has been hardened on real incidents and real upgrades.

web agencies hosted
3
sites in production
~400
years as developer and architect
10+

What’s included

Six modules. One coherent stack.

Use the full stack or pick the pieces you need.

Solved for you

The hard parts, already done.

  • Built from scratch, for you

    Everything is deployed from zero, with CI/CD pipelines tailored to each agency’s or startup’s needs — on any host, any cloud.

  • Your own private GitLab

    A private GitLab server set up for your code, your pipelines and your team.

  • Tight Docker subnets

    Several stacks share one host without network collisions.

  • Backups with tested restores

    Automated backups of volumes and databases — and restores that have actually been tested.

  • Monitoring and TLS

    Grafana supervision, with TLS certificates centralized at the entry point.

Coming next

Roadmap

Multi-machine.

A Traefik “shield” server is the only public entry point; backends run on other machines, linked by a private WireGuard network with automatic key exchange (Netbird or Headscale). Traefik discovers services through Docker labels.

Internet
SHIELD Traefik Only public entry point
Private WireGuard networkNetbird / Headscale
Backend Adocker labels
Backend Bdocker labels
Backend Cremoved from pool

Pricing

Open source. Paid support when you need it.

No day rate that drags on: a price known upfront.

  • Community

    Run it yourself.

    Free open source

    • Full stack and every module
    • Documentation
    • On your own servers
    • Community support
    Get the code
  • Setup

    Turnkey setup

    We install it with you.

    €5,000–15,000 excl. VAT, one-time

    • Price based on the number of services
    • Private GitLab server set up
    • Stack deployed on your servers
    • Pipelines wired to your projects
    • Backups, monitoring and TLS configured
    Request a quote

  • Support

    We keep it running.

    Starting at €400 excl. VAT / month

    • Stack updates
    • Help when something breaks
    • Tailored response time
    • Direct line to the architect
    Talk to us

Who’s behind it

Nicolas Guillard

Nitrique Concept · nitrique.fr

Developer and architect since 2015, Nicolas has built the DevOps chain of every project he has led.

A Symfony developer before becoming DevOps, he speaks your developers’ language.

Save a week on your next project.

Tell us about your stack. We’ll tell you what it takes.

Let’s talk