Hi all,
I am trying to find out if there is interest in a hosted Forgejo service with a strong emphasis on EU sovereignty and independence from big tech. Forgejo is an open-source Git hosting platform that I think is great and deserves wider use. For that reason, we will donate 5% of our plan revenue to the Forgejo project.
The plan is to cover what developers and small teams need:
- Forgejo for Git hosting
- Servers at Scaleway (a European cloud provider)
- CI/CD runners
- Dependency vulnerability alerts on every plan
- Daily backups
- Other essentials, as listed on our features page
Vault42 (that’s us) has no US parent company and uses only EU-based subprocessors, so your code stays outside US jurisdiction. ISO 27001 certification is a goal for later on.
The focus will be on private repositories, since Codeberg already serves open-source projects very well. There will also be a free plan for open source with unlimited public repositories, not to compete with Codeberg but to give people another option.
If this interests you, you can join the waitlist at vault42.eu.
Questions and suggestions are welcome in the comments or by DM.
Cheers,
Marijn from Vault42
Disclosure: I am the founder of Vault42.
Y E S.
How is CI/CD going to look? I currently have many different Github workflows and they are the main thing keeping me from switching to a different platform; the issue is the ecosystem of third party workflows is gigantic, so a competitor ideally needs to be able to run them out of the box, or require only a minor refactor.
Hi! Thanks for your reply :)
This is exactly why I want to offer hosted CI/CD, so that EU GitHub users can actually make the switch. To be honest, I’m still working a lot of this out, and I can’t promise a seamless one-to-one transition from GitHub Actions to Forgejo Actions. They are very similar, but there are differences.
What I can say: Forgejo Actions uses nearly the same workflow syntax, and if a repository has no .forgejo/workflows folder, it reads your existing .github/workflows folder. Most third-party actions work too: common ones resolve by their usual name, and you can reference others by their full GitHub URL.
Hosted runners will offer a lean default image and a GitHub-compatible one, so most workflows should run unchanged or with a small change.
The biggest exception is actions that talk to GitHub itself, such as creating GitHub releases or commenting on pull requests. Those need a Forgejo alternative. There are a few smaller differences as well, such as artifact uploads using Forgejo’s own version of the upload-artifact action.
I want to make this transition as smooth as possible, and for complex setups like yours I’m happy to help directly.
I already do: Codeberg
What I want is a federated Forgejo with strong moderation tools.
I’m a fan of federation and decentralisation too, when done well. It isn’t what we’re building, though. Vault42 is meant as a professional alternative for teams moving away from GitHub and other non-EU platforms, so our focus is on things like CI/CD with self-hosted runners and vulnerability alerting. Federation in Forgejo is still under development upstream; once it is stable, we will certainly look at enabling it.
I know it’s still in development. I still want it, though. And once it’s done, it would make a lot of sense for a company/org to hire hosting and administration of an instance just for them. A lot more professional to have your code on code.myorg.net/project than on any 3rd party site (whether it’s github, gitlab, codeberg, you name it).
I heavily use GitHub because all the tooling supports it easily. I tried moving away to Codeberg as Github started to have many connectivity issues. Unfortunately, Codeberg does not allow repositories that use LLM’s. I don’t like to have a provider telling me how I should use/make my software.
So if you provide managed git, where I can do ci/cs/cd on self-hosted runners, I’d be super happy and even willing to pay for that.
Thanks, that is useful to hear. Vault42 runs on Forgejo, so Forgejo Actions with self-hosted runners is supported out of the box: you can register your own runner for a single repository, for all of your personal repositories, or for an organisation, and your builds never touch our machines unless you want them to.
If you’d like to try it, there is a beta waitlist at https://vault42.eu/beta.
Having european alternatives is great but honestly for private repos I’d rather just spin up a Forgejo instance myself on my own hardware.
Exactly. Since Vault42’s market appears to be corporate clients, its sole value proposition then is to handle the infrastructure a company would have maintain otherwise, is it?
Pretty much and by large, yes, compared with self-hosting: we run the servers, upgrades, backups and CI. Compared with GitHub or GitLab.com, the difference is jurisdiction: no US parent company, and most importantly, no Cloud Act, and only EU subprocessors.
Vault42 is meant for people who want both, for mainly freelancers, small agencies and small teams without anyone to spare for running such infrastructure.
I’d say using ARM or RISC-V CPUs is a good idea just in case.
That is a good tip! I will look into that!
While I’d like to spin my own hardware, I still have to pay for external service to punch through my ISP’s NAT and access my server from outside. I also have to buy external backups from someone and all this costs pile up and running my own server is prohibitively expensive compared to just using codeberg.
Ah, neither my office nor my home is plagued by cgnat. That would certainly make a difference in options.
And wireguard and duplicati/proxmox-backup don’t get you there?
You know the community: they’d love to help you set up any of those. ;-)
Can wireguard alone let me access my servwr from outside the NAT without having an external server?
Does duplicati have free tier for external backups?
If by ISP NAT you mean you never have a unique external IP for your ISPs router then no, wireguard does nothing for you there.
Was about to suggest something like Netbird (also uses Wireguard), which has free tier I believe. Also using that myself for some instances I don’t need public facing.
Atleast Netbird is European. Thanks!
That’s what I do as well. There’s interest (in a Github alternative) from my side and that’s why I already spun up my own Forgejo instance. So I’m fine. I suppose the perspective here is skewed, though. There’s probably also people who don’t selfhost.
Yes. Just don’t forget to never expose them publicly, those things are full of CVEs
I was going to say Codeberg is in Berlin, Germany. They also allow private.
Good luck to you, I hope the project goes well!
Hi FiniteBanjo,
Thanks for your reply and kindness :)
You are right that Codeberg does offer private repo’s but it’s under a pretty limiting set of rules, especially for commercial projects, which is more my aim. See https://docs.codeberg.org/getting-started/faq/#how-about-private-repositories?
[…] If you do not contribute to free/libre software (or if it is limited to your personal homepage), and we feel like you only abuse Codeberg for storing your commercial projects or media backups, we might get unhappy about that.
Codeberg is great for open source though. Vault42 is meant for the private and client work that falls outside their scope.
You’re not going to scale on Forgejo, or at least Codeberg isn’t managing it. Since AI scrapping has become rampant they are struggling with availability.
I think small open source commercial businesses would want this. Even if there’s overlap with Codeberg we need options for a healthy market. I hope you suceed and bookmarked for my own future hosting needs.
No, I’d rather use ForgeFed and have it all decebtralised, like Git is meant to be.
Forgejo is developing ForgeFed though
Sure, but I don’t want “GitHub, but in the EU”, as the post suggests.
Nothing here mentions federated forges. I agreee it’d be nice for those that don’t want to selfhost, but we need to ensure there’ll be more decentralisation in the future.
Just look at how Autistici/Inventati got shut down because one mad person on the other side of the world decided he didn’t like them. Good luck shutting down much more decentralised infrastructure. And this will only become more important, not less.
Correct me if I’m wrong but their suggestion is the creation of just another platform within that federated network. I don’t see an issue with that, if you don’t like their practices on the server, you move your repo. I think for federated networks to work, solutions, that are aimed at people who want things to simply work stable, need to exist to make migration viable. Not everybody wants to self host and there needs to be solutions and servers that provide services to enterprise customers.
Doesn’t this open up significant vulnerability vectors? Curious how you could prevent malicious use and injection.
Well, basically in the same way as with the fediverse, email, XMPP, SSH and every other service on the internet.
You look at what you receive and don’t simply trust what is sent to you.
How do you handle things like
- custom domains
- federation with an identity provider of the customer
- customization for look and feel and technical (limitations for repo sizes etc.)
- how do you handle connections to customer internal systems like artifactory, wiki, issue tracker, jira, etc.
I could not find an information about that on your site.
Working in a large corporation and also having worked on SaaS solutions these are important topics. Without even some rudimentary Information about that I wouldn’t even consider your service.
Code hosting is the easy part. Propperer Integration eithwith external systems and separating customer data is the hard part.
Thanks, these are fair questions and valid concerns, and you’re right that the site doesn’t cover them properly yet.
The smaller plans will run on a shared platform aimed at freelancers and small teams. For companies with requirements like yours, there will be an Enterprise plan with an isolated Forgejo instance on dedicated infrastructure. That’s where most of your points come in:
- Custom domains: will be possible on a dedicated instance.
- Identity provider: Forgejo supports OpenID Connect and LDAP, so a dedicated instance can be connected to your own identity provider.
- Customisation and limits: look and feel, repository and storage limits, and other settings will be configurable per dedicated instance.
- Internal systems: webhooks and the API cover most tools, and Forgejo can link to an external wiki or issue tracker such as Jira. For systems inside your network, such as Artifactory, you’ll be able to run Forgejo runners on your own infrastructure, so CI can reach them without exposing them to the internet.
- Data separation: Enterprise customers will get their own instance, so their data won’t be shared with other customers.
I agree that hosting is the easy part and integration is the hard part, this is also the part that makes it worth doing for me :).
If you could provide this information on your site (including an explanation about the process on his to set it up) that would be great!
Are there limitations planned in regards to the amount of users for the enterprise plan?
Hi,
I put up an enterprise page with more details: https://vault42.eu/enterprise
It’s also referred to from the main page several times. Let me know if this satisfies your needs!
Cheers :)
As is stated in the pricing card of the enterprise, the plan starts at a certain amount, and is tailored to the needs of the customer. So it really depends on what the needs of the enterprise customer will be.
And yes, will put the info on the website, thanks for suggestions! These kind of questions really help clarify the offerings before we begin :)
Much appreciated!
I think that one of the biggest challenges you may face is that source code is probably one of the areas where corporate customers care the least about things like the CLOUD Act or FISA 702. Simply because the main legal issue comes from processing of customers personal data, and that data should never end up in a Git repo. The company I work for is pretty strict with EU data residency, to the point that we have products with strict EU data sovereignty requirements (i.e. no US providers in the chain), and looking to move workloads off US clouds… but nobody has ever cared about GitHub because in the end the source code is only classified as Corporate Confidential, not Sensitive or Highly sensitive.
That said, a possible selling point if you’re targeting EU companies might be DORA compliance. I am saying this because something that did come up was if we needed a DORA addendum with GitHub since we do a lot of GitOps… and GitHub did not want to sign any addendum.
This is really valuable information. For financial customers, being able to sign a DORA addendum makes a lot of sense, and I’ll look into it more closely. There are probably similar regulations in other industries that could be relevant too? ISO 27001 certification is already on the roadmap.
Thanks a lot, I really appreciate it!
Yes, I would use and I’m currently looking for a solution. Good to see viable alternatives showing up.
Codeberg for open source is ok, even though I don’t completely agree with the AI ban.
For private repositories I only know about Codefloe (https://codefloe.com/), which is also hosted and run in europe. I haven’t started any migration yet, but I will add vault42.eu to the list of possible destinations.
I’d stick to Codeberg. I have no problem open-sourcing large portions of my work in return for a few private repos, and I don’t use much of their disk-space either.
IMHO, it’s a complicated product-market fit. Most commercial clients don’t care where the money goes and are happy to use github with EU data residency. Open source projects have many free options and can’t afford paid solutions most of the time. The potential clients are pretty much just big, well funded open source projects that want to escape GIthub’s AI. There are some of them but I don’t know how many.
