Hi all,
I am trying to find out if there is interest in a hosted Forgejo service with a strong emphasis on EU sovereignty and independence from big tech. Forgejo is an open-source Git hosting platform that I think is great and deserves wider use. For that reason, we will donate 5% of our plan revenue to the Forgejo project.
The plan is to cover what developers and small teams need:
- Forgejo for Git hosting
- Servers at Scaleway (a European cloud provider)
- CI/CD runners
- Dependency vulnerability alerts on every plan
- Daily backups
- Other essentials, as listed on our features page
Vault42 (that’s us) has no US parent company and uses only EU-based subprocessors, so your code stays outside US jurisdiction. ISO 27001 certification is a goal for later on.
The focus will be on private repositories, since Codeberg already serves open-source projects very well. There will also be a free plan for open source with unlimited public repositories, not to compete with Codeberg but to give people another option.
If this interests you, you can join the waitlist at vault42.eu.
Questions and suggestions are welcome in the comments or by DM.
Cheers,
Marijn from Vault42
Disclosure: I am the founder of Vault42.
How is CI/CD going to look? I currently have many different Github workflows and they are the main thing keeping me from switching to a different platform; the issue is the ecosystem of third party workflows is gigantic, so a competitor ideally needs to be able to run them out of the box, or require only a minor refactor.
I heavily use GitHub because all the tooling supports it easily. I tried moving away to Codeberg as Github started to have many connectivity issues. Unfortunately, Codeberg does not allow repositories that use LLM’s. I don’t like to have a provider telling me how I should use/make my software.
So if you provide managed git, where I can do ci/cs/cd on self-hosted runners, I’d be super happy and even willing to pay for that.
Thanks, that is useful to hear. Vault42 runs on Forgejo, so Forgejo Actions with self-hosted runners is supported out of the box: you can register your own runner for a single repository, for all of your personal repositories, or for an organisation, and your builds never touch our machines unless you want them to.
If you’d like to try it, there is a beta waitlist at https://vault42.eu/beta.
I already do: Codeberg
What I want is a federated Forgejo with strong moderation tools.
I’m a fan of federation and decentralisation too, when done well. It isn’t what we’re building, though. Vault42 is meant as a professional alternative for teams moving away from GitHub and other non-EU platforms, so our focus is on things like CI/CD with self-hosted runners and vulnerability alerting. Federation in Forgejo is still under development upstream; once it is stable, we will certainly look at enabling it.
I know it’s still in development. I still want it, though. And once it’s done, it would make a lot of sense for a company/org to hire hosting and administration of an instance just for them. A lot more professional to have your code on code.myorg.net/project than on any 3rd party site (whether it’s github, gitlab, codeberg, you name it).
I think small open source commercial businesses would want this. Even if there’s overlap with Codeberg we need options for a healthy market. I hope you suceed and bookmarked for my own future hosting needs.
Having european alternatives is great but honestly for private repos I’d rather just spin up a Forgejo instance myself on my own hardware.
Exactly. Since Vault42’s market appears to be corporate clients, its sole value proposition then is to handle the infrastructure a company would have maintain otherwise, is it?
Pretty much and by large, yes, compared with self-hosting: we run the servers, upgrades, backups and CI. Compared with GitHub or GitLab.com, the difference is jurisdiction: no US parent company, and most importantly, no Cloud Act, and only EU subprocessors.
Vault42 is meant for people who want both, for mainly freelancers, small agencies and small teams without anyone to spare for running such infrastructure.
I’d say using ARM or RISC-V CPUs is a good idea just in case.
While I’d like to spin my own hardware, I still have to pay for external service to punch through my ISP’s NAT and access my server from outside. I also have to buy external backups from someone and all this costs pile up and running my own server is prohibitively expensive compared to just using codeberg.
Ah, neither my office nor my home is plagued by cgnat. That would certainly make a difference in options.
And wireguard and duplicati/proxmox-backup don’t get you there?
You know the community: they’d love to help you set up any of those. ;-)
Can wireguard alone let me access my servwr from outside the NAT without having an external server?
Does duplicati have free tier for external backups?
If by ISP NAT you mean you never have a unique external IP for your ISPs router then no, wireguard does nothing for you there.
Was about to suggest something like Netbird (also uses Wireguard), which has free tier I believe. Also using that myself for some instances I don’t need public facing.
Atleast Netbird is European. Thanks!
Yes. Just don’t forget to never expose them publicly, those things are full of CVEs
That’s what I do as well. There’s interest (in a Github alternative) from my side and that’s why I already spun up my own Forgejo instance. So I’m fine. I suppose the perspective here is skewed, though. There’s probably also people who don’t selfhost.
I was going to say Codeberg is in Berlin, Germany. They also allow private.
Good luck to you, I hope the project goes well!
Hi FiniteBanjo,
Thanks for your reply and kindness :)
You are right that Codeberg does offer private repo’s but it’s under a pretty limiting set of rules, especially for commercial projects, which is more my aim. See https://docs.codeberg.org/getting-started/faq/#how-about-private-repositories?
[…] If you do not contribute to free/libre software (or if it is limited to your personal homepage), and we feel like you only abuse Codeberg for storing your commercial projects or media backups, we might get unhappy about that.
Codeberg is great for open source though. Vault42 is meant for the private and client work that falls outside their scope.
How do you handle things like
- custom domains
- federation with an identity provider of the customer
- customization for look and feel and technical (limitations for repo sizes etc.)
- how do you handle connections to customer internal systems like artifactory, wiki, issue tracker, jira, etc.
I could not find an information about that on your site.
Working in a large corporation and also having worked on SaaS solutions these are important topics. Without even some rudimentary Information about that I wouldn’t even consider your service.
Code hosting is the easy part. Propperer Integration eithwith external systems and separating customer data is the hard part.
Thanks, these are fair questions and valid concerns, and you’re right that the site doesn’t cover them properly yet.
The smaller plans will run on a shared platform aimed at freelancers and small teams. For companies with requirements like yours, there will be an Enterprise plan with an isolated Forgejo instance on dedicated infrastructure. That’s where most of your points come in:
- Custom domains: will be possible on a dedicated instance.
- Identity provider: Forgejo supports OpenID Connect and LDAP, so a dedicated instance can be connected to your own identity provider.
- Customisation and limits: look and feel, repository and storage limits, and other settings will be configurable per dedicated instance.
- Internal systems: webhooks and the API cover most tools, and Forgejo can link to an external wiki or issue tracker such as Jira. For systems inside your network, such as Artifactory, you’ll be able to run Forgejo runners on your own infrastructure, so CI can reach them without exposing them to the internet.
- Data separation: Enterprise customers will get their own instance, so their data won’t be shared with other customers.
I agree that hosting is the easy part and integration is the hard part, this is also the part that makes it worth doing for me :).
If you could provide this information on your site (including an explanation about the process on his to set it up) that would be great!
Are there limitations planned in regards to the amount of users for the enterprise plan?
As is stated in the pricing card of the enterprise, the plan starts at a certain amount, and is tailored to the needs of the customer. So it really depends on what the needs of the enterprise customer will be.
And yes, will put the info on the website, thanks for suggestions! These kind of questions really help clarify the offerings before we begin :)
Much appreciated!
I think that one of the biggest challenges you may face is that source code is probably one of the areas where corporate customers care the least about things like the CLOUD Act or FISA 702. Simply because the main legal issue comes from processing of customers personal data, and that data should never end up in a Git repo. The company I work for is pretty strict with EU data residency, to the point that we have products with strict EU data sovereignty requirements (i.e. no US providers in the chain), and looking to move workloads off US clouds… but nobody has ever cared about GitHub because in the end the source code is only classified as Corporate Confidential, not Sensitive or Highly sensitive.
That said, a possible selling point if you’re targeting EU companies might be DORA compliance. I am saying this because something that did come up was if we needed a DORA addendum with GitHub since we do a lot of GitOps… and GitHub did not want to sign any addendum.
This is really valuable information. For financial customers, being able to sign a DORA addendum makes a lot of sense, and I’ll look into it more closely. There are probably similar regulations in other industries that could be relevant too? ISO 27001 certification is already on the roadmap.
Thanks a lot, I really appreciate it!
No, I’d rather use ForgeFed and have it all decebtralised, like Git is meant to be.
Forgejo is developing ForgeFed though
Sure, but I don’t want “GitHub, but in the EU”, as the post suggests.
Nothing here mentions federated forges. I agreee it’d be nice for those that don’t want to selfhost, but we need to ensure there’ll be more decentralisation in the future.
Just look at how Autistici/Inventati got shut down because one mad person on the other side of the world decided he didn’t like them. Good luck shutting down much more decentralised infrastructure. And this will only become more important, not less.
Doesn’t this open up significant vulnerability vectors? Curious how you could prevent malicious use and injection.
Well, basically in the same way as with the fediverse, email, XMPP, SSH and every other service on the internet.
You look at what you receive and don’t simply trust what is sent to you.
Yes, I would use and I’m currently looking for a solution. Good to see viable alternatives showing up.
Codeberg for open source is ok, even though I don’t completely agree with the AI ban.
For private repositories I only know about Codefloe (https://codefloe.com/), which is also hosted and run in europe. I haven’t started any migration yet, but I will add vault42.eu to the list of possible destinations.
I’d stick to Codeberg. I have no problem open-sourcing large portions of my work in return for a few private repos, and I don’t use much of their disk-space either.
IMHO, it’s a complicated product-market fit. Most commercial clients don’t care where the money goes and are happy to use github with EU data residency. Open source projects have many free options and can’t afford paid solutions most of the time. The potential clients are pretty much just big, well funded open source projects that want to escape GIthub’s AI. There are some of them but I don’t know how many.
This is interesting, especially if you can customize it for game development. Most gamedevs are still using github as Codeberg doesn’t allow commercial projects (?). If you can integrate this with Godot, Bevy, Fyrox etc I’d say you have a good chance of finding users. I know EU studios like Larian are using Gitlab, but for indie devs who can’t self host, this could prove to be an alternative.
-
Are you hosting this on your hardware or using a host ?
-
I saw community governance on the site, that is great. Are you registered as a non-profit or PBC ? Being either of these’d give indie devs much more assurance
Hi, thanks for this reply, I love your ideas.
Being a home for indie game developers is definitely something I aspire to, because 1) I’m a hobby gamedev myself, and 2) I love indie games and the community.
The technical side is quite doable, since you can point your Forgejo runner at any image that builds games, and the same goes for Rust projects. Still, we could work together to find sensible, workable defaults if you’d like.
On your two questions:
- We use a French cloud provider called Scaleway, which is 100% European.
- “Community governed” on the site refers to Forgejo itself. I’ll make that clearer on the site. Vault42 is currently run by me as a self-employed sole trader registered in the Czech Republic, with help from a few freelancers. There are no investors and no parent company, in the US or anywhere else. It isn’t a non-profit, and a PBC is a US legal form, so that doesn’t apply here. Supporting Forgejo is part of the plan, though, which is why 5% of plan revenue goes to the project.
-
Any level of extra sovereignty makes a big difference for big customers, so the answer is yes. But for individual developers and start-ups, it’ll come down to if your owners have stock in USA/Israeli companies.
If they do then there is no sovereignty. Rewarding a capitalist who happens to have an EU member passport is still rewarding an USA capitalist. There’s no difference and other than with the odd nationalistic one, all of them will primarily have loyalty towards the USA regardless of on-paper nationality. It’s simply the pragmatic choice when you are a capitalist.
And so any reason to be scared of hosting in the USA will still apply. You’ll still over-comply, rat us out, censor us, invite USA-competitors to study our private repos. And it’ll be based on the exact same cheap orders from the USA, and you’ll still ignore our national laws with as little care as a Microsoft, Google, or indeed as a SAP.
Without sovereignty, what you’re doing is just using nationalism to market a product. We all know putting the USA flag on a product in the USA works great. Used to not work as good in Europe, but now make that an EU flag and it doesn’t feel nationalistic, so it works. But the reason it doesn’t feel nationalistic is because the implication is that it’s sovereign. People will catch on that it isn’t very soon.
Depending on how strict you want to be, you might also need to disallow USA puppets like the Gulf countries and the UK from your owner’s portfolios. And a lot of others are going to be upset to see Russia or China on there too.
I really get that sentiment, because I share it too, to a certain extent. Putting an EU sovereignty sticker on a product that is still tied, one way or another, to the things it claims to reject is basically false advertising, if you ask me.
I care about EU sovereignty and independence from big tech because I want technology to do good, rather than harm the environment and people. That is the reason I started this project and why I’m testing whether others care about it as much as I do, and I’m glad to see that you are one of them.
Concretely: Vault42 has no investors and no parent company. It is run by me as a sole trader in the Czech Republic, and all subprocessors are EU-based. US legal orders such as the CLOUD Act have no direct reach. Anyone wanting data would have to go through Czech and EU law, as with any other European company. And nobody at Vault42 looks into private repositories, for competitors or anyone else.
Sovereignty really is a spectrum, and it has to cover the whole chain of operation, continuously. Keeping that up will probably be the biggest task in running this project. I intend to do it in a way that lets people like you and me feel safe, so that technology serves us rather than using us.
I’m curious: what would you need to see from a product like this before you’d trust it with your code?
I’m curious: what would you need to see from a product like this before you’d trust it with your code?
I’d probably take you (or any given service) at your word, but you need to actually advertise the advantages. Of course it’s risky, it’s easy to be heavy-handed or to signal your position in a way that dissuades someone. But if you don’t properly name the fears, I have no reason to think you’re addressing the fears either.
Because you’re one person I trust your intention now, but that isn’t a good angle either, because now I wouldn’t trust your longevity and procedures for dealing with disasters (paying for availability after the business venture has failed so customers can download their data for a few months after sunset, money to deal with cyber attacks, stuff like that).
The biggest seal of quality thing that’s possible for you to get with your current angle is to get a government (even just a city or province) customer and saying you’re trusted by them, or getting some sort of official commission to develop for the public sector. Then the customer would feel safe the funding is intended to achieve the stated goals. But you can’t will those contracts into existence either.
