The Context
CAMTEL-TECH Services is a Cameroonian IT services SME: network installation, infrastructure maintenance, technical support, and IT project management. HQ in Yaoundé, branch in Douala, roughly 200 employees, many of them working in the field and needing remote access to documents.
The problem wasn't technical, it was strategic: the company stored its data in a local NAS, Google Workspace Business and Dropbox Business. Heterogeneous solutions, non-uniform access rights, scattered personal data, inconsistent backups, hosting beyond any legal control, that's 7 concrete GDPR non-compliance risks identified, in a business where every uncontrolled shared file is potential evidence against the company.
The project goal: propose a sovereign, secured alternative to public clouds, a private cloud based on Nextcloud, and document it at a professional level.
The dispersion problem
Local NAS + Google Workspace + Dropbox: impossible to locate personal data, control access, enforce the right to erasure, or prove an audit trail.
The sovereignty problem
Google and Dropbox store data in international cloud infrastructure, potential violations of the GDPR's rules on transfers outside the EU.
The field problem
Employees connect from public networks and personal devices: access rights must be centralized, reliable, and least-privilege enforced.
What I Built
Specification document in 4 sections, the central deliverable, structured like a professional study:
- Context description: project frame, problem statement (the multi-tool dispersion), objectives, scope and limits.
- Functional specification: requirements inventory via the MoSCoW method (Must/Should/Could/Won't), main use cases, Nextcloud functional architecture.
- Technical specification: storage, security and data-management needs assessment; infrastructure architecture; Nextcloud deployment plan; data migration plan; GDPR and ISO 27001 regulatory compliance.
- Financial specification: capital expenditure (CAPEX), operating expenditure (OPEX) estimates, comparative cost-benefit analysis, and financing options.
Architecture & diagrams: the hybrid infrastructure design (local datacenter + secured field access) modelled in EdrawMax, architecture diagram, functional diagrams, and data flow diagram.
Real deployment, full Docker stack: the associated practical work involved deploying Nextcloud 28 in a containerized stack: Nextcloud 28 (Apache) + MariaDB 11 (with healthcheck), Redis 7 for caching, Nginx reverse proxy with hardened security headers (X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy), WebSocket support (Nextcloud Talk), high upload limits (10 GB), credentials handled via environment variables, no hardcoded secrets.
Synthesis deliverables: Word document presenting the project, PowerPoint deck for the supervisor presentation, and an end-to-end tutorial from deployment to administration.
Impact
GDPR compliance by design
The specification answers every obligation: data localization, access control, right to erasure, traceability, backup and retention, including ISO 27001 alignment.
Digital sovereignty
An open-source alternative to public-cloud giants: the company takes back control of its data, hosted and administered locally.
Computed financial decision
CAPEX, OPEX and cost-benefit analysis sized for a real context (~200 employees), usable by a decision-maker, not a theoretical exercise.
From specification to deployment
The Nextcloud/MariaDB/Redis/Nginx Docker stack was deployed and documented, the project doesn't stop at design.
What This Experience Taught Me
A specification document isn't writing: it's structured engineering. Translating a real GDPR problem, seven concrete non-compliance risks, into MoSCoW requirements, then into CAPEX/OPEX figures, taught me how to make a technical solution auditable and defensible in front of a decision-maker: every choice (Nextcloud over public clouds, MariaDB/Redis, reverse proxy, secrets in .env) has an economic and regulatory justification, not just a technical one.
And the complete loop, specification, architecture, real deployment, tutorial, oral defense, is the best way to verify that an architecture designed on paper runs in practice.