Your people just open the app.
The top layer is the only one most people ever see: the app they open in the browser, behind one sign-in. Every layer below it is there so that this one stays simple. Divan, a work platform running on an estate we built and run, is one app at this layer.
What it holds
| Divan | one app at this layer: chat, documents, meetings, workflows, search and AI |
|---|---|
| Web front end | what the browser loads |
| Authentik sign-in | the one sign-in in front of every app |
| Collabora Online | documents, edited in the browser |
| draw.io | diagrams, in an editor the estate runs itself |
| mediasoup and coturn | video calls, inside the estate |
What it promises
One sign-in
People sign in once, with your own directory if you have one. Every app sits behind the same sign-in.
Calls stay in the estate
Video meetings run on mediasoup and coturn inside the estate, not through a third-party meeting service.
Documents and diagrams in one place
Collabora Online and draw.io run as services of the estate, so documents and diagrams open beside the rest of the work.
Nothing underneath to learn
The proxy, the backups and the build pipeline stay out of sight. People open the app and nothing else.
What people ask
Will our people need another password?
Not if you run Active Directory. They sign in with their directory username and password, and your directory checks the password at each login.
Where do our video calls go?
Through mediasoup and coturn, which run inside the estate. Calls do not pass through a third-party meeting service.
Is Divan the only app this layer can hold?
No. Divan is one example. Each app in the estate gets its own sign-in client in Authentik, so every app your people use sits behind the same sign-in.