Something you might want to consider given you mention "it should be managed by a non sysadmin"- What happens when something goes wrong and you cant access anything?

As much as i like to self host what I can, sometimes it is worth considering other options