Whiteboarding and diagramming
Whiteboarding and diagramming
Sketch diagrams together in real time on a self-hosted Excalidraw instance. You operate the two public domains it needs; Quake AI provides the Compute instance and network it runs on.
What this is for#
A small trusted team that sketches architecture diagrams or brainstorms visually together needs a lightweight, real-time collaborative canvas. Excalidraw (a self-hosted alternative to Figma or Miro for lightweight diagramming) gives a team that canvas, running on infrastructure you own instead of a public collaboration server. The outcome is a whiteboard your team reaches at its own domain, deployable from a validated OpenTofu template and its companion tutorial.
Reference architecture#
Download diagram: SVG, PNG, and PDF.
The base is a single validated template: Excalidraw whiteboard provisions the instance and network Excalidraw runs on.
-
Team members. Teammates open the frontend's HTTPS address and draw together in a live session.
-
Two reverse proxies. Excalidraw needs two separate public hostnames, each with HTTPS termination. Use the edge reverse proxy template: one Caddy hostname block for the frontend and one for the collaboration domain, with WebSocket upgrade enabled on the collaboration block.
-
Excalidraw frontend. The Excalidraw whiteboard template runs the Excalidraw frontend on port 8080 in Docker on a Compute instance, with an entrypoint patch that rewrites the built JavaScript's hardcoded collaboration URL to point at your own domain.
-
excalidraw-room server. The collaboration server relays end-to-end-encrypted drawing data between connected clients on port 8081; it persists nothing server-side.
Services involved#
| Service | Role in this architecture | Docs |
|---|---|---|
| Compute | Hosts the frontend and collaboration-server containers | Compute |
| Network | Private network, security group, and floating IP for public access to both domains | Network |
Get started#
- Excalidraw whiteboard template: OpenTofu pattern that provisions the instance and network; no credential to generate, and the lightest ops-tools footprint in this library (2 vCPU, 2 GiB RAM).
- OpenTofu template library: browse validated IaC starting points for other self-hosted team tools.
Estimate the cost#
Monthly cost estimate
Pricing calculator ↗Sized as a custom package on shared vCPU.
Monthly total for the required template above. Use the configurator below to add optional pieces and see the total update.
What each resource is for
Excalidraw whiteboard host
s1a.small · 2 shared vCPU, 2 GiB RAM, 0.5 Gbps
Runs the Excalidraw frontend and the excalidraw-room collaboration server as two stateless containers on the same instance, with no bundled datastore.
Both containers are lightweight and stateless, so 2 vCPU and 2 GiB RAM covers a small team; the lightest ops-tools footprint in this library alongside Uptime Kuma.
Compute shown per role at custom-package rates ($29/dedicated vCPU, $7.25/shared vCPU, $1/GiB RAM). The headline above is the billed total: the cheaper of a named plan and the custom package, plus add-ons.
Included in baseline
s1a.small
2 shared vCPU, 2 GiB RAM, 0.5 Gbps
Compute + RAM rate basis
2 vCPU + 2 GiB RAM at $29/dedicated vCPU, $7.25/shared vCPU, $1/GiB RAM (regular). Totals apply the flat −$5/mo package promotion.
Block storage (20 GiB)
20 GiB at $0.08/GiB/mo
Public IP (included)
1 included with the custom package
Package promotional discount
Flat −$5.00/mo on the custom package (same promotion as named plans).
Included at no charge
These line items are zero on Quake AI. Many other providers meter them separately.
Data transfer (inbound and outbound)
Unlimited data transfer on every plan; Quake AI does not meter per-GB egress.
AWS, GCP, and Azure meter outbound transfer per GB. DigitalOcean and Hetzner include an allowance on compute plans, then charge overage.
Learn morePrivate networking
Private networks, subnets, Neutron routers, and security groups are included with the plan.
VPC objects are usually free to create elsewhere, but NAT gateways bill hourly plus per-GB processed. Quake AI uses router SNAT with no separate NAT line item.
Control-plane API requests
OpenStack API calls for provisioning and management are included.
Some managed services on other clouds meter API calls or charge for premium control-plane features.
Pricing data last validated: . For current rates, check quake.ai/pricing.
Considerations and limits#
- Requires HTTPS on both domains. Excalidraw's end-to-end encryption uses
window.crypto.subtle, which browsers only expose on a secure context. Both the frontend and collaboration domains need working HTTPS before a session functions. - No built-in authentication on the collaboration server. Anyone with a live share link can join that room, which suits a small trusted team rather than a public-facing deployment.
- Nothing to back up server-side. Drawing content lives in each browser's local storage; the room server relays data without persisting it.
- Flat egress. Quake AI applies a no-egress-fee policy for outbound transfer.
- Three US regions. All current regions are in the United States.
- Compliance posture. Quake AI holds SOC 2 Type I and Type II attestations and SOC 3. See Compliance and certifications for the platform scope.