GUINNESS Global Investors
Prepared for Tom & Will · Guinness
The Guinness Platform · Operator Companion

Infrastructure, Explained — what runs, where, and how to operate it.

Where "How It Works" explained what the platform is and why you are not locked in, this document explains the machine room: what is actually running, where it runs, and how a change becomes live. Written for the people who will operate the platform — no supplier jargon, no internal references.

Verified against the running system · June 2026
In one paragraph

The entire Guinness suite — a front-door shell plus ten applications and an in-house data engine — runs on one dedicated server that Guinness owns. On that server, an open-source control panel (Coolify) builds each app from an on-box code vault (Gitea) and runs it in its own container; a single routing layer (Traefik) terminates HTTPS and routes each Guinness web address to the right app. There is no external dependency at runtime — code, build and serving all live on this one machine — which is exactly what makes a clean handover to Guinness possible.

1
Dedicated server
11
Guinness apps live
3
Open-source layers
0
External deps at runtime
01The big picture

One owned machine — three layers, one front door

Internet · Guinness staff · your systems
HTTPS · your Guinness web addresses
Your dedicated server — one machine, Guinness-owned Standard Linux server · German data centre
Layer 1 — Control panel (Coolify)
Open-source · self-hosted · one dashboard for everything
builds appsruns containers manages settingsreads logs
Layer 2 — Code vault (Gitea)
All source code, on-box · 11 app repositories
supplier line · read-onlyGuinness line · deploys
Layer 3 — Routing & TLS · Traefik Let's Encrypt certs · routes by web address · auto-renewal
Your application containers — each independently deployed
Orion · front door AthenaLexaIris JessJulesMaia IonaGeorgiaBrian In-house data engine
Supplier update arrives mirror · read-only Code vault · supplier line reviewed · applied Guinness line control panel build Goes live
GUINNESSInfrastructure, Explained · 1 / 7
02Layer one · the server & control panel

Hetzner + Coolify — one server, a self-hosted control panel

One Hetzner Cloud server in Germany runs the whole suite. Nothing on it is proprietary to the supplier: a stock Linux operating system running standard containers. On it, Coolify — an open-source, self-hosted platform-as-a-service — orchestrates everything via Docker: it builds each app from the on-box code vault and runs it as a container, managing settings, domains, and TLS. Coolify is to this deployment what a cloud platform is to a cloud-hosted app — but self-hosted, so it belongs to Guinness.

Your dedicated serverKey-secured · Linux · standard hardware
Control panel — Coolify (open-source)
One dashboard · builds, runs, and manages every app
app buildscontainer runtime environment configTLS management
Your apps — one project, one environment
11 apps · each in its own container · each with its own web address
Orion · front door10 appsIn-house data engine
Updates arrive via the code vault On-box only · no external build services
The layered server — control panel, your apps, and the on-box deploy path. No external build service; no outside system needed to deploy.
Verified June 2026
  • All 11 apps up — zero stopped containers
  • Plenty of headroom — disk and memory mostly free
  • Control panel and routing layer healthy
  • Each app runs independently — one failure doesn't affect others
Why self-hosted matters
  • Coolify is open-source and standard. If Guinness ever wishes to change supplier, the control panel moves with the box — there is no proprietary lock-in at the infrastructure layer.
  • Moving provider is a routine server migration, not a rebuild.
Day-to-day operations
  • One box, one view. If you can reach the control panel, you can see and operate the entire estate.
  • Restart or redeploy an app from the control panel without touching any other app.
  • Logs are available per-app directly in the control panel.
GUINNESSInfrastructure, Explained · 2 / 7
03Layer two · the code vault

Gitea & the ownership model — Guinness controls what deploys

All application source code and history lives on a self-hosted code vault (Gitea) running on the box — the blueprints, kept on-site. The model is two lines per app: a supplier line (a read-only mirror of what the supplier ships) and a Guinness line (what actually deploys). Supplier updates arrive on the mirror for visibility and are applied to the Guinness line deliberately — a conscious decision, not an automatic event.

Supplier updatearrives on schedule
mirror
read-only
Supplier lineread-only · never edited · visible
reviewed
applied deliberately
Guinness line ▸ deployswhat actually runs · controlled
Handover line Remove the supplier's inbound credential → the code vault stands alone; the Guinness line keeps deploying. The supplier's systems are never exposed to Guinness's production environment.
The control panel only ever deploys the Guinness line. The deployed line tracks the supplier automatically but is never blindly equal to it.
Verified June 2026
  • 11 app repositories in the Guinness-owned code vault
  • Two-line pattern confirmed across all supplier-originated apps
  • The in-house data engine has one line only — born in the code vault, no supplier origin
  • Regular sync running cleanly — zero conflicts across all repos
  • What you read in the Guinness line is exactly what is running — no hidden artefacts
What this means for Guinness
  • You control the deploy switch. The supplier can propose updates; only the Guinness line deploys — and adopting an update is a conscious choice.
  • To freeze production (e.g. before a client demo): set the pause flag in the code vault; clear it to resume.
  • The Guinness line is the audit trail — a complete history of every change that ever went live.
  • Handover = remove one credential. The code vault and all its history stays exactly where it is, on the box.
GUINNESSInfrastructure, Explained · 3 / 7
04Layer three · the application suite

The Orion shell & the apps behind it

guinnessgi.x-trillion.com is the front door — an Orion shell presenting a sidebar of apps, each loaded independently from its own Guinness web address. Eleven app containers run on the box, each deployed with its own address and certificate, so rebuilding or restarting one never affects any of the others or the shell itself.

Browser Routing layer · TLS Orion shell · front door → loads each app independently → AthenaLexaIrisJessJulesMaiaIonaGeorgiaBrian
Each app runs at its own web address. Rebuilding one app does not affect the others. The shell enforces which origins it trusts.
AppWhat it is
Orion (shell)The front door — the sidebar interface that hosts all apps.
AthenaPortfolio cockpit — NAV, yield, duration, holdings, P&L, and compliance checks.
LexaSovereign credit research — deep country reports, served via API.
IrisInteractive investment guide — the GGI AI Hub for staff and clients.
JessNarrated video briefings — market and fund commentary, with its own access control.
JulesCompliance and brand audit — deck and factsheet review, slide generation.
MaiaExecution airlock — the bridge between Athena and order execution.
IonaWealthy Nations Bond Fund voice briefings — audio-first fund commentary.
GeorgiaSovereign ESG Scorer — live World Bank data, password-gated.
BrianThe in-shell help agent — context-aware guidance across all apps.
Data engineGuinness's in-house data engine — sovereign data, Haver feeds, and the path to full in-house analytics (see §5).
GUINNESSInfrastructure, Explained · 4 / 7
05The independence model

The in-house data engine — independence running, not promised

The first genuinely Guinness-owned service — a lean engine that sits between the apps and their data. It serves sovereign fundamentals natively from licence-free public data (World Bank), and Guinness's own Haver subscription — a feed Guinness funds directly. For anything it cannot yet serve, it falls transparently to the interim engine, stamping every answer with its source. This is the independence model in motion: two data circuits already in-house, the rest available to bring across on Guinness's own timeline.

Your appsask the engine
for data
● In-house — World Bank + Haver (owned)
Sovereign fundamentals and macro time series are served directly from licence-free public data and Guinness's own Haver subscription. No external analytics in the path. Grows over time.
○ Interim — supplier fallback (transparent)
Anything the engine cannot yet serve natively is routed to the interim engine transparently — and stamped with its source so it is always clear which circuit answered. Shrinks as more moves in-house.
Born in the code vault — no supplier origin. The external connection is a single configuration value; repoint it to change the fallback with nothing else touched.
Verified live · in-house path confirmed
  • World Bank sovereign data live — confirmed on real 2024 figures for multiple countries
  • Haver macro time series live — fed from Guinness's own Haver subscription
  • Every answer stamped with its source — you can always see which circuit responded
  • Engine running on the box — minimal footprint, zero restarts
Honest current state
  • In-house today: sovereign macro data (World Bank) and macro time series (Haver). Both genuinely live on real numbers.
  • Coming in-house on Guinness's timeline: bond analytics, pricing, and ratings — each moves across as the relevant licence or engine lands. No platform rebuild needed.
This is the "not locked in" story running: the supply of each data circuit is a configuration choice, not a code change.
The ownership model in practice
  • Born in the code vault. This engine has no supplier origin — it is Guinness's own service, on Guinness's own box.
  • Re-sourcing, not recomputing. When an in-house circuit is ready, it answers from the new source with the same number — books and reports are never affected.
GUINNESSInfrastructure, Explained · 5 / 7
06Access & security

Three access planes — each locked to its audience

Access is layered by audience. Staff and clients reach the apps through a single email one-time-code login — no per-app passwords to remember. Operators (Tom & Will) access the control panel and code vault through their own authenticated dashboards. The server itself is locked to authorised keys only — no password login, no guessable entry point.

Users
Email + one-time passcode, shared across all apps. A single sign-in gives access to every app in the suite. No per-app passwords.
Services
Apps communicate with each other and with data engines using signed tokens — no secrets visible to the browser, no internal addresses exposed.
Infrastructure
Key-only access — password login to the server is disabled. The control panel and code vault are behind their own HTTPS logins.
Who logs in where
WhoWhereWhat they can do
All staffFront door — guinnessgi.x-trillion.comThe apps — one email one-time-code sign-in; all most users ever need.
Ops (Tom & Will)Control panel — your Guinness control panel addressApp status, logs, restart, redeploy, environment settings.
Developers (Will)Code vault — your Guinness code vault addressSource code, history, branch management, and when new versions go live.
Machines onlyIn-house data engineNo login — apps call it directly over the internal network; not exposed to browsers.
Access confirmed June 2026
  • All app logins operating via email one-time-code — no passwords stored in the apps
  • Control panel and code vault: login-gated with their own credentials
  • Machine-to-machine endpoints: bearer-token gated — a 401 is returned to anything without a valid token
  • Personal accounts for Tom & Will ready once work email addresses are confirmed — each with a forced password change on first sign-in
GUINNESSInfrastructure, Explained · 6 / 7
07The path forward · handover & independence

Three switches — not three rebuilds

The platform was built with handover as a design goal, not an afterthought. The steps are credential actions, not migrations: nothing moves, nothing is rebuilt — access and control shift. What Guinness already owns is concrete and running today.

What Guinness owns — concrete, not aspirational
The dedicated server Coolify · the control panel Gitea · the code vault + all history In-house data engine · Guinness-born code

What runs in production is, by construction, exactly the Guinness line in the code vault — no hidden build artefact, no supplier-side dependency.

1
Dedicated server project
Move the server into a project named for Guinness; grant Guinness's own account access to just that project. Clean billing and access boundary — the server is unambiguously yours.
2
Detach supplier sync
Remove one credential or set the pause flag — the code vault becomes a standalone source of truth. The supplier's systems are never exposed; the Guinness line keeps deploying exactly as before.
3
In-house data engine absorbs
Already serving sovereign data and Haver feeds in-house. Each additional data circuit moves across as the relevant licence or engine lands — on Guinness's timeline, not the supplier's.
The bottom line · verified June 2026
  • No external dependency at runtime — code, build and serving all live on one owned machine.
  • Handover is a credential action, not a migration — the server, control panel, code vault and data engine are already Guinness's.
  • The first two in-house data circuits (World Bank sovereign data · Haver macro series) are live and verified; the rest move in-house on Guinness's timeline.
  • Personal operator accounts for Tom & Will ready to activate once email addresses are confirmed.
GUINNESSInfrastructure, Explained · 7 / 7