Hi all,
I am trying to find out if there is interest in a hosted Forgejo service with a strong emphasis on EU sovereignty and independence from big tech. Forgejo is an open-source Git hosting platform that I think is great and deserves wider use. For that reason, we will donate 5% of our plan revenue to the Forgejo project.
The plan is to cover what developers and small teams need:
- Forgejo for Git hosting
- Servers at Scaleway (a European cloud provider)
- CI/CD runners
- Dependency vulnerability alerts on every plan
- Daily backups
- Other essentials, as listed on our features page
Vault42 (that’s us) has no US parent company and uses only EU-based subprocessors, so your code stays outside US jurisdiction. ISO 27001 certification is a goal for later on.
The focus will be on private repositories, since Codeberg already serves open-source projects very well. There will also be a free plan for open source with unlimited public repositories, not to compete with Codeberg but to give people another option.
If this interests you, you can join the waitlist at vault42.eu.
Questions and suggestions are welcome in the comments or by DM.
Cheers,
Marijn from Vault42
Disclosure: I am the founder of Vault42.
I think small open source commercial businesses would want this. Even if there’s overlap with Codeberg we need options for a healthy market. I hope you suceed and bookmarked for my own future hosting needs.
I already do: Codeberg
How do you handle things like
- custom domains
- federation with an identity provider of the customer
- customization for look and feel and technical (limitations for repo sizes etc.)
- how do you handle connections to customer internal systems like artifactory, wiki, issue tracker, jira, etc.
I could not find an information about that on your site.
Working in a large corporation and also having worked on SaaS solutions these are important topics. Without even some rudimentary Information about that I wouldn’t even consider your service.
Code hosting is the easy part. Propperer Integration eithwith external systems and separating customer data is the hard part.
Thanks, these are fair questions and valid concerns, and you’re right that the site doesn’t cover them properly yet.
The smaller plans will run on a shared platform aimed at freelancers and small teams. For companies with requirements like yours, there will be an Enterprise plan with an isolated Forgejo instance on dedicated infrastructure. That’s where most of your points come in:
- Custom domains: will be possible on a dedicated instance.
- Identity provider: Forgejo supports OpenID Connect and LDAP, so a dedicated instance can be connected to your own identity provider.
- Customisation and limits: look and feel, repository and storage limits, and other settings will be configurable per dedicated instance.
- Internal systems: webhooks and the API cover most tools, and Forgejo can link to an external wiki or issue tracker such as Jira. For systems inside your network, such as Artifactory, you’ll be able to run Forgejo runners on your own infrastructure, so CI can reach them without exposing them to the internet.
- Data separation: Enterprise customers will get their own instance, so their data won’t be shared with other customers.
I agree that hosting is the easy part and integration is the hard part, this is also the part that makes it worth doing for me :).
If you could provide this information on your site (including an explanation about the process on his to set it up) that would be great!
Are there limitations planned in regards to the amount of users for the enterprise plan?
As is stated in the pricing card of the enterprise, the plan starts at a certain amount, and is tailored to the needs of the customer. So it really depends on what the needs of the enterprise customer will be.
And yes, will put the info on the website, thanks for suggestions! These kind of questions really help clarify the offerings before we begin :)
Much appreciated!
I think that one of the biggest challenges you may face is that source code is probably one of the areas where corporate customers care the least about things like the CLOUD Act or FISA 702. Simply because the main legal issue comes from processing of customers personal data, and that data should never end up in a Git repo. The company I work for is pretty strict with EU data residency, to the point that we have products with strict EU data sovereignty requirements (i.e. no US providers in the chain), and looking to move workloads off US clouds… but nobody has ever cared about GitHub because in the end the source code is only classified as Corporate Confidential, not Sensitive or Highly sensitive.
That said, a possible selling point if you’re targeting EU companies might be DORA compliance. I am saying this because something that did come up was if we needed a DORA addendum with GitHub since we do a lot of GitOps… and GitHub did not want to sign any addendum.
This is really valuable information. For financial customers, being able to sign a DORA addendum makes a lot of sense, and I’ll look into it more closely. There are probably similar regulations in other industries that could be relevant too? ISO 27001 certification is already on the roadmap.
Thanks a lot, I really appreciate it!
Having european alternatives is great but honestly for private repos I’d rather just spin up a Forgejo instance myself on my own hardware.
Yes. Just don’t forget to never expose them publicly, those things are full of CVEs
While I’d like to spin my own hardware, I still have to pay for external service to punch through my ISP’s NAT and access my server from outside. I also have to buy external backups from someone and all this costs pile up and running my own server is prohibitively expensive compared to just using codeberg.
And wireguard and duplicati/proxmox-backup don’t get you there?
You know the community: they’d love to help you set up any of those. ;-)
Can wireguard alone let me access my servwr from outside the NAT without having an external server?
Does duplicati have free tier for external backups?
If by ISP NAT you mean you never have a unique external IP for your ISPs router then no, wireguard does nothing for you there.
Was about to suggest something like Netbird (also uses Wireguard), which has free tier I believe. Also using that myself for some instances I don’t need public facing.
Atleast Netbird is European. Thanks!
Ah, neither my office nor my home is plagued by cgnat. That would certainly make a difference in options.
Exactly. Since Vault42’s market appears to be corporate clients, its sole value proposition then is to handle the infrastructure a company would have maintain otherwise, is it?
Pretty much and by large, yes, compared with self-hosting: we run the servers, upgrades, backups and CI. Compared with GitHub or GitLab.com, the difference is jurisdiction: no US parent company, and most importantly, no Cloud Act, and only EU subprocessors.
Vault42 is meant for people who want both, for mainly freelancers, small agencies and small teams without anyone to spare for running such infrastructure.
I’d say using ARM or RISC-V CPUs is a good idea just in case.
That’s what I do as well. There’s interest (in a Github alternative) from my side and that’s why I already spun up my own Forgejo instance. So I’m fine. I suppose the perspective here is skewed, though. There’s probably also people who don’t selfhost.
I was going to say Codeberg is in Berlin, Germany. They also allow private.
Good luck to you, I hope the project goes well!
Hi FiniteBanjo,
Thanks for your reply and kindness :)
You are right that Codeberg does offer private repo’s but it’s under a pretty limiting set of rules, especially for commercial projects, which is more my aim. See https://docs.codeberg.org/getting-started/faq/#how-about-private-repositories?
[…] If you do not contribute to free/libre software (or if it is limited to your personal homepage), and we feel like you only abuse Codeberg for storing your commercial projects or media backups, we might get unhappy about that.
Codeberg is great for open source though. Vault42 is meant for the private and client work that falls outside their scope.
Yes, I would use and I’m currently looking for a solution. Good to see viable alternatives showing up.
Codeberg for open source is ok, even though I don’t completely agree with the AI ban.
For private repositories I only know about Codefloe (https://codefloe.com/), which is also hosted and run in europe. I haven’t started any migration yet, but I will add vault42.eu to the list of possible destinations.
No, I’d rather use ForgeFed and have it all decebtralised, like Git is meant to be.
Doesn’t this open up significant vulnerability vectors? Curious how you could prevent malicious use and injection.
Well, basically in the same way as with the fediverse, email, XMPP, SSH and every other service on the internet.
You look at what you receive and don’t simply trust what is sent to you.
Forgejo is developing ForgeFed though
Sure, but I don’t want “GitHub, but in the EU”, as the post suggests.
Nothing here mentions federated forges. I agreee it’d be nice for those that don’t want to selfhost, but we need to ensure there’ll be more decentralisation in the future.
Just look at how Autistici/Inventati got shut down because one mad person on the other side of the world decided he didn’t like them. Good luck shutting down much more decentralised infrastructure. And this will only become more important, not less.
IMHO, it’s a complicated product-market fit. Most commercial clients don’t care where the money goes and are happy to use github with EU data residency. Open source projects have many free options and can’t afford paid solutions most of the time. The potential clients are pretty much just big, well funded open source projects that want to escape GIthub’s AI. There are some of them but I don’t know how many.
I’d stick to Codeberg. I have no problem open-sourcing large portions of my work in return for a few private repos, and I don’t use much of their disk-space either.
This is interesting, especially if you can customize it for game development. Most gamedevs are still using github as Codeberg doesn’t allow commercial projects (?). If you can integrate this with Godot, Bevy, Fyrox etc I’d say you have a good chance of finding users. I know EU studios like Larian are using Gitlab, but for indie devs who can’t self host, this could prove to be an alternative.
-
Are you hosting this on your hardware or using a host ?
-
I saw community governance on the site, that is great. Are you registered as a non-profit or PBC ? Being either of these’d give indie devs much more assurance
Hi, thanks for this reply, I love your ideas.
Being a home for indie game developers is definitely something I aspire to, because 1) I’m a hobby gamedev myself, and 2) I love indie games and the community.
The technical side is quite doable, since you can point your Forgejo runner at any image that builds games, and the same goes for Rust projects. Still, we could work together to find sensible, workable defaults if you’d like.
On your two questions:
- We use a French cloud provider called Scaleway, which is 100% European.
- “Community governed” on the site refers to Forgejo itself. I’ll make that clearer on the site. Vault42 is currently run by me as a self-employed sole trader registered in the Czech Republic, with help from a few freelancers. There are no investors and no parent company, in the US or anywhere else. It isn’t a non-profit, and a PBC is a US legal form, so that doesn’t apply here. Supporting Forgejo is part of the plan, though, which is why 5% of plan revenue goes to the project.
-
