Why these together

The privacy-first stack is the one a security-conscious team or a regulated org self-hosts to keep data inside its own perimeter. Plausible measures the public site without cookies and without pushing visitor data to a US ad-tech vendor; Vaultwarden stores credentials end-to-end-encrypted with the official Bitwarden clients; Authentik is the SSO that fronts every internal service so an offboarded employee loses access in one operation; Joplin is the encrypted notes app that replaces Evernote without uploading plaintext to anyone; Jitsi runs the video meetings that Zoom would route through US servers. The compose.yml on this page ships Vaultwarden + Joplin Server (+ postgres) — the two single-purpose pieces that close credential and notes egress with one file. Plausible (postgres + clickhouse), Authentik (server + worker + postgres + redis), and Jitsi (multi-container with STUN/TURN) have heavier installs and ship their own first-party composes, linked from inside the file. The full intended endpoint is all five behind a single reverse proxy with Authentik forward-auth, so you log in once and the rest of the stack inherits the session — that wiring is left to the operator since proxy choice is environment-specific.