Quokka Advisory
Our work
ALT VFX Forge · turnkey application platform

AI-built applications.
Enterprise-ready foundations.

Quokka designed and built Forge so ALT VFX can develop useful applications with enterprise capabilities built in. Templates, automation and operating methods carry AI-assisted prototypes through to applications the studio can run and support.

ALT VFX
The challenge

Building an application was
only part of the job.

ALT VFX develops applications for its creative work. AI made prototyping easier; operating those applications still needed specialist engineering. The studio needed a dependable way to release, monitor, support and recover its software without becoming an infrastructure team.

What Quokka brought

Put the engineering
into the foundation.

We designed and implemented a shared platform with reusable templates, automation and operating methods. Developers and AI tools use the same conventions. The engineering sits beneath the application, ready to be reused.

Forge as a whole

The team defines the application.
Forge carries the complexity.

What the studio works onThe application and its purpose

Build the studio tool. Describe the capabilities it needs.

Templates · schemas · AI skills

Describe it once.

  • Templates and common schemas
  • Skills for AI-assisted development
  • Checks before release preparation
Ansible · shared services · operating methods

Use the shared capabilities.

  • Studio sign-in, step-up authentication and secrets
  • Storage, databases, certificates and DNS
  • Elastic monitoring, APM, backups and release controls
The team works through a common interface. Quokka’s platform engineering and operating methods handle the standard integrations underneath.
The benefit to ALT VFX

More time for the studio’s work.

Build the application that matters

Develop useful studio tools with AI while reusing the platform’s services. The team does not have to rebuild the operating foundation for every prototype.

Use the expertise built into Forge

Standard templates provide enterprise capabilities without bespoke infrastructure integrations. Elastic monitoring and APM are available out of the box.

Keep it operable as it grows

Common definitions carry into controlled releases, support and recovery. Further applications reuse the same foundation.

Forge is in place, and Quokka completed the Griptape administration server deployment. Further applications follow their own validation, migration and recovery plans.

The platform underneath

The complexity is built in.
The team works through a template.

Templates and shared schemas connect AI-assisted development to the services needed in operation. Ansible carries the underlying configuration.

The interface for the studio

Build with AI. Describe what the application needs.

Application templatesA supported starting point
Common schemasRuntime, access, storage & data
AI skillsThe platform’s patterns and checks
GitLabControlled GitOpsVersioned definitions · reviewed changes
  1. 01DefineCode + application contract
  2. 02Build & checkCI images + readiness checks
  3. 03Prepare & reviewAnsible release artefacts
  4. 04Release & verifyOperator applies; behaviour checked
AnsibleThe engineering behind the simple interfaceReusable roles configure the platform and prepare application releases from the shared definitions.

Applications & runtime

  • Container orchestration
  • Application publishing
  • Health & readiness checks
  • Repeatable release configuration
K3sRancherHelm

Identity & access

  • Active Directory integration
  • Shared sign-in
  • Duo MFA & step-up authentication
  • Application entry groups
Keycloak

Network & DNS

  • Service routing
  • Network policy
  • Automated DNS records
  • Controlled application exposure
CiliumEnvoy

Certificates & secrets

  • Certificate issuance & renewal
  • Step CA certificate authority
  • External Secrets integration
  • Centrally held credentials
cert-manager1Password

Storage

  • Existing studio storage mounts
  • Persistent application volumes
  • S3-compatible object storage
  • PowerScale CSI integration
Dell PowerScale · NFS · S3

Databases & cache

  • Database provisioning requests
  • Reviewed PostgreSQL workflow
  • Patroni high availability
  • Shared Redis cache
PostgreSQLRedis

Monitoring & APM

  • Elastic monitoring
  • Application performance monitoring
  • Central logs, metrics & traces
  • Application & platform health
Elastic

Backup & recovery

  • pgBackRest database backups
  • Persistent-data recovery methods
  • Versioned release artefacts
  • Rollback & recovery checks
pgBackRest · operating runbooks
Built on the studio’s infrastructureRocky LinuxVMware vSphereDell PowerScale
For the people building the softwareEnterprise capabilities, without becoming an infrastructure specialist.
Shared capabilities are selected through the application’s definition. PostgreSQL provisioning uses its own reviewed workflow; production changes are applied by an authorised operator. The application’s behaviour, permissions and recovery are verified before it is accepted into service.
Architecture · design · implementation

Designed, built
and made repeatable.

Quokka brought the architecture, implementation and operating methods together so the foundation could be reused across studio applications.

01

Design the whole environment

Identity, networking, data, monitoring and recovery designed together around the studio’s infrastructure.

02

Build the common methods

Ansible roles, schemas and templates make the engineering repeatable. AI skills explain the patterns; automated checks enforce them.

03

Carry it into operation

Controlled releases, operating procedures and handover give the team a consistent way to support and recover its applications.

Supporting engineering

Inside Forge.

How the templates and automation turn shared services into capabilities an application can use.

AI skills and templates guide the build

Forge gives developers and their AI tools a standard starting point: application templates, shared schemas and skills that explain the supported patterns. The declaration covers runtime components, access, storage, service exposure and data requirements. Automated readiness checks catch missing requirements and unsafe defaults before release preparation; application behaviour is checked as part of acceptance.

A common schema carries the operating requirements

The application keeps its adopted publishing template alongside its code. Versioned schemas and validators check the declaration, then Ansible prepares the configuration and immutable release artefacts. A developer can request the standard capabilities through that contract instead of writing a separate set of platform manifests and integrations.

Controlled GitOps, with an explicit release boundary

GitLab CI builds and publishes application images. Forge prepares the release from those images and validated definitions; an authorised operator applies the change. Database requirements produce a request for the separate, reviewed PostgreSQL provisioning workflow. Application schema migrations and business permissions remain with the application.

Certificates, DNS and secrets handled centrally

ExternalDNS manages records for published services within the platform’s assigned zones. cert-manager and Step CA support automated certificate issuance and renewal. 1Password and External Secrets provide the shared secret-delivery pattern. Applications use these services through the standard configuration rather than maintaining their own copies.

Storage and database services through standard requests

Applications can use persistent volumes, existing studio storage mounts and S3-compatible object storage. The templates describe the required storage and data connections; the platform supplies the established integration patterns. PostgreSQL provisioning follows a reviewed request workflow, while Redis provides a shared cache service. Existing storage exports and application data remain under their respective owners’ control.

Elastic monitoring and APM come with the foundation

Elastic provides the common monitoring and application performance monitoring (APM) capability. The standard application patterns bring logs, health information and traces into that shared view, so the team can investigate application behaviour without building a separate monitoring stack. Recovery methods cover configuration, releases and persistent data, with database backups through pgBackRest. Each application’s recovery behaviour is checked against its own requirements.

Shared sign-in, with permissions enforced in the application

Keycloak connects the studio’s Active Directory and Duo to a common sign-in service. Envoy checks the authenticated session and application entry groups, removes caller-supplied identity headers and passes trusted user context to the application. The application still enforces its own business permissions. Sensitive actions can request fresh MFA through the same shared identity flow.

  1. Workforce identityActive Directory & Duo

    Existing accounts and multifactor authentication.

  2. Shared sign-inKeycloak

    Authenticate the person and support fresh MFA for sensitive actions.

  3. Application entryEnvoy gateway

    Check the session and entry groups. Pass trusted identity to the app.

  4. Business permissionsStudio application

    Decide what that person can read, change or administer.

The arrows show how identity reaches an application, not a physical network layout. The application retains responsibility for enforcing its business permissions.

Architecture, detailed design, implementation and application enablement by Quokka Advisory for ALT VFX.

More of our work

All project stories
Connectivity & network security

Connect the studios. Keep security in the path.

Routing, load sharing and network security across ALT VFX’s studios, data centres and AWS connections.

ALT VFX
Visual effectsCase study
Digital workspaces

Production workspaces built for demanding creative work.

Secure access to physical workstations and virtual desktops, with GPU acceleration planned around production workloads.

ALT VFX
Visual effectsCase study

What needs to work better?

Talk to us about the environment, the constraint and the change.

Talk to Quokka