How we built a multi-tenant SaaS platform on self-hosted open-source infrastructure

This article describes a real, ongoing project delivered for the owner of a B2B SaaS email deliverability platform in Moldova and Romania. The client is anonymized. The team includes backend, frontend and DevOps engineers with full-stack coverage. The platform started from scratch (greenfield) and keeps growing.

Project goals

• Design and build a multi-tenant SaaS platform from scratch: architecture, backend and frontend, in one continuous engagement.
• Run entirely on self-hosted, open-source infrastructure, with no vendor lock-in and full control over cost and data.
• SRE practices from day one: observability, SLO-based alerting and incident runbooks, not bolted on later.
• Complete technical documentation (C4 diagrams and ADRs), for long-term maintainability, not just working code.

Application architecture

The platform uses a microservices architecture, with three backend services written in Go: the delivery engine, billing/CRM and campaign management. The frontend is a Next.js/React dashboard plus a public landing page, both bilingual (EN/RO).

A native CRM is integrated directly into billing, with no third-party CRM dependency.

Tenant isolation

Strict data isolation between customers is verified with dedicated tests written for every route (cross-tenant tests). Across all backend services there are more than 600 automated tests, confirmed independently at every change.

Infrastructure

The platform runs on Docker Compose and on an HA Kubernetes cluster with a 3-node control plane, ready for CloudNativePG. Components include PostgreSQL ×3, RabbitMQ and Keycloak, all self-hosted.

DNS management is automated: SPF, DKIM and DMARC records are updated dynamically through TSIG-signed updates.

SRE and observability

• SLO-based alerting, using error-budget burn rate.
• An incident runbook built from real incidents.
• An in-house, Prometheus-compatible metrics package, plus Loki for logs and automatic log-based error classification.

Self-hosted AI

A self-hosted LLM (Ollama) powers an AI sales chat and classifies incoming replies, with zero external API cost. The team also explored MCP-style tool calling, for secure, tenant-scoped data access from the chat.

The stack at a glance

Working model

The feature list keeps growing: the team is actively building new functionality on this platform, rather than wrapping up a delivery and moving on. The model is one team, embedded long-term, evolving the product as the client's needs grow.