CairnServer by Monoform Digital

One server, properly run

A platform that fits on a box you own.

CairnServer turns a single rented machine into managed infrastructure: sites, mail, certificates, containers and firewall, each handled by a service that does one job and asks permission for the rest. Drive it from a control panel, or from an API, or leave it alone entirely.

See the stack Something running on it

What the box runs

CairnServer is the whole box. Cairn is the control plane inside it — nine services that do the work — and CairnControl is the panel you drive them from. GraniteAuth and TerraneCMS are products in their own right, sold separately and used by people who never touch a Cairn box.

Every CairnServer also ships with a sovereign GraniteAuth — your own identity provider, on your own machine, with your users in your database. No tenancy in someone else's system, and nothing to migrate if you later want the hosted one instead.

The control plane Running

Cairn

Nine services manage what a server actually does — Caddy sites, Postfix domains, nftables rules, podman containers, PHP-FPM pools — and none of them run as root.

A privileged broker sits between them and the system, and it accepts exactly four operations against a fixed table of paths. Not a permission model that can be widened later: a list, compiled in. An integrity monitor watches for edits made outside that path and reports them.

  • rust
  • four operations
  • audit fingerprinting
  • confirm-or-revert
Identity · sold separately Running

GraniteAuth

Identity, delegated. Stateless JWT auth with per-surface and per-collection permissions, so an application on the box never keeps a password table of its own.

Built reseller-shaped: a customer can stand up their own multi-tenant app against the API and resell authentication without writing a password-storage line of code.

A product in its own right, and the largest thing we have built — twice the size of the control plane it runs on. graniteauth.com

Sold hosted and multi-tenant. A sovereign instance ships with every CairnServer: same software, your machine, your user table. Identity is the one thing worth owning outright, and the one thing most platforms will not let you.

  • rust
  • oidc
  • multi-tenant
  • rbac
Sites · sold separately In build

TerraneCMS

Git for sites. A CMS where a website is versioned like code: branch it, propose a change, review a real diff with author attribution, merge, publish, roll back.

The database is where you work; the public site serves a pinned, captured version, so nothing goes live unreviewed. AI builders design themes and sections as reviewable data rather than running code — machines propose, humans admit.

Identity is delegated to GraniteAuth entirely — TerraneCMS keeps no users table of its own, which is what the two products being separate buys you.

  • branches
  • three-way merges
  • instant rollback
  • identity via granite
The interface In build

CairnControl

The panel: sites, mail domains, containers, firewall rules and certificates, managed the way cPanel or Forge manage a server — without needing to know what a quadlet is.

The server does not depend on it. CairnControl talks to the same HTTP API anything else would, and every service keeps running whether the panel is installed, stopped, or never deployed at all. A panel that can take the box down with it is not a panel, it is a liability.

  • sites
  • mail domains
  • containers
  • firewall
  • php pools
  • tokens
104k lines across the stack
9 services on the box
4 privileged operations
0 workers running as root
1 sovereign identity provider, included

Why one box, not a cloud account

Most platforms rent you a share of someone else's machine and price it per seat, per site, per gigabyte. That works until it doesn't — until the bill scales with success, or the platform deprecates the thing you built on.

A cairn is a marker built from what is already on the hill. CairnServer is the same idea: the hardware is a commodity you rent by the month, and everything above it is yours. Adding another site costs a container and a config block, not a line item.

The interesting constraint is not how much a server can do. It is how little privilege it needs to do it.

That constraint is why the broker takes four operations and not a general API, why workers write config but never reload services, and why a file changed outside the system shows up as an alert rather than going unnoticed.

It is also why identity ships sovereign. A platform you can be evicted from is not infrastructure, it is a tenancy — and the account system is the lock on that door.

Free for good causes

CairnServer is sold commercially by Monoform Digital. It is also given away: charities, community groups and nonprofits get a hosted instance at no cost through Community Bits.

That is possible because the marginal cost of one more instance on hardware already paid for is close to nothing — which makes it a real offer rather than a discount off a price nobody in the sector could afford anyway.

Community Bits