If you’re building a startup in Europe and you’ve ever looked at your infrastructure bill and thought “I’m paying three US companies to hold my source code, credentials, and incident logs,” this is for you.
SOVRAK (the working name you’ll still see rendered as “Sovereign Stack” in the CLI’s own output) is a strongly opinionated CLI tool that generates a complete, pre-integrated internal operations platform – source control, CI/CD, identity management, monitoring, password management, documentation, email, and compliance – from a single interactive setup, so you skip the weeks of stitching these components together yourself. Everything runs on your own EU infrastructure, with no US-operated services and no US-jurisdiction operator anywhere in the chain – which is what takes it out of CLOUD Act reach.
Plenty of curated self-hosted lists end with an implied “good luck wiring it all together”; here the wiring (identity, routing, TLS, backups, compliance monitoring) is already done. You run the CLI, answer the prompts, deploy to a VM, and you’re working.
What you get out of the box
Here’s each piece of the stack and the problem it solves for you as a founder – not how it works internally, but why it’s there.
Centralized identity and access control with Authentik. Every service in the stack sits behind single sign-on with mandatory multi-factor authentication. Hire someone, create one account, and they can access everything. When someone leaves, deactivate that account and they’re locked out immediately, across all services. Authentik also supports WebAuthn passkeys, the same tech behind Face ID, Touch ID, and Windows Hello, which are phishing-resistant by default. Access control at this level is a NIS2 Article 21 requirement, and you get it configured on day one.
Source control with Gitea. A self-hosted Git platform that’s fast, lightweight, and familiar if you’ve used GitHub. Your code stays on your infrastructure, which matters both for sovereignty and for any customer who asks where their data pipeline source lives.
Continuous deployment with Woodpecker CI. Push code to Gitea, Woodpecker picks it up via webhookwebhookAn automatic ‘ping’ one app sends another the moment something happens - here, Gitea telling the CI system ‘new code was just pushed, go build it.’ and runs your pipeline. It authenticates through Gitea’s OAuth2 – and because Gitea federates to Authentik when you’ve selected it, you still get single sign-on, just one hop further out. Either way the OAuth app is created for you, so there’s no manual setup. If you’ve used Drone CI, Woodpecker will feel immediately familiar – it’s a community fork with the same YAML pipeline format. You have CI/CD from day one, instead of a “set up Jenkins” ticket that never quite reaches the top of the backlog.
Password and credential management with Vaultwarden. A Bitwarden-compatible server that your entire team can use with the standard Bitwarden browser extension and mobile apps. Self-hosted means your credential vault isn’t sitting in a US data center. The admin panel is protected behind Authentik’s forward authforward authA checkpoint at the front door: before a request reaches an app that has no login of its own, the gateway asks your central login service ‘is this person signed in?’ and only then lets it through. , and Vaultwarden handles its own encryption layer inside that – defense in depth without any extra configuration.
Monitoring, metrics, and logs with Prometheus, Grafana, Loki, and Grafana Alloy. All four are configured and connected. Alloy automatically ships logs from every Docker container to Loki. Prometheus scrapes metrics. Grafana gives you dashboards. When something breaks at 2 AM, you have centralized logs and metrics in one place instead of SSHing into a server and tailing files. Grafana authenticates through Authentik, so it’s part of the same SSO umbrella. And those container logs aren’t a privacy blind spot: client IPs are truncated by the proxy before they’re ever written (a /24 for IPv4, /64 for IPv6 – data you never collected needs no erasure), everything is auto-deleted after 31 days by Loki’s retention, and logs are deliberately excluded from backups.
Team documentation with Outline. A clean, fast wiki for your runbooks, architecture decisions, onboarding docs, and policies. File attachments are stored in Hetzner Object Storage (S3-compatibleS3-compatibleSpeaks the same storage language as Amazon S3, the de-facto standard for cloud file storage - so tools that expect S3 work with Hetzner’s EU storage unchanged. , EU-hosted), and the wiki is immediately available to your whole team through the same login they use for everything else in this stack.
Email and newsletters with Listmonk. A self-hosted mailing list manager that sends through Brevo’s SMTP relay (a French company, free tier allows 300 emails per day, reasonable pricing for higher volume). Admin routes are protected by Authentik; public endpoints like unsubscribe links work without authentication. When you need to send product updates to early users or manage a waitlist, it’s already running.
Governance, risk, and compliance with CISO Assistant. This is the piece most stacks leave out entirely, and it’s arguably the most valuable for an EU startup. CISO Assistant is built by Intuitem, a French company, and it handles compliance tracking across GDPR, NIS2, ISO 27001, DORA, and the Dutch BIO2 baseline. The SOVRAK CLI pre-configures it with the frameworks you select and generates a provisioning script, run automatically on first boot, that seeds your asset inventory, supplier register, applied controls, a baseline risk assessment, and per-framework audits directly into its database. Instead of staring at a blank GRC tool and wondering where to start, you get a pre-populated environment mapped to the specific components you’ve deployed.
GDPR data-subject rights with the Erasix component. Where CISO Assistant tracks what you’re supposed to be doing, Erasix does it: right-to-erasure requests with cryptographically signed receipts, data portability exports, consent management with an embeddable banner, a tamper-evident audit trail, and retention enforcement. The redistributable SDK also ships a Loki provider (Fortibus.Sovereignty.Loki): if your application logs user emails, adding .AddLoki() folds those log lines into your app’s erasure and export answers – your app holds the email, so it can resolve which lines are the subject’s. Platform logs themselves are handled by minimization and retention instead (previous section), a deliberate choice: a receipt should never attest to a search the system can’t actually perform. Your users get a self-service privacy portal at privacy.ops.yourdomain.eu – they sign in with a verified-email link (no account on your ops stack needed), see their data, request an export or deletion, and download the result – while you get an operator API behind Authentik for handling requests that come in by email. The portal carries your branding and speaks your users’ languages from operator-supplied translation files. When a user invokes GDPR Article 17, the answer is a button, not a two-week scramble. (Curious how that button got built? The sovereignty build-diary series on this blog retraces the whole service, decision by decision.)
The integration is the product
Any experienced developer could deploy each of these tools individually. The value of SOVRAK is that the weeks of integration work are already done.
Caddy sits in front of everything as a reverse proxyreverse proxyA gatekeeper server in front of your apps: every web request hits it first, and it forwards each one to the right app - handling HTTPS and login checks in one place.
with automatic TLSTLSThe encryption behind the padlock in your browser - it scrambles traffic between visitors and your server so nobody in between can read it. (The ‘S’ in HTTPS.) Let’s Encrypt issues the certificates for free.
from Let’s Encrypt. Every service gets a subdomain of your ops domain – auth.ops.yourdomain.eu, git.ops.yourdomain.eu, ci.ops.yourdomain.eu, and so on. Caddy handles HTTPS termination, HTTP/3, and gzip/zstd compression for every service without any per-service configuration.
When Authentik is in the stack, everything ends up behind one login, though the mechanism differs by service. Gitea, Outline, and CISO Assistant sign in through Authentik via OIDC directly. Grafana auto-logs-in from the Caddy-verified session through a proxy header. Woodpecker authenticates through Gitea, which itself federates to Authentik. And underneath all of it, every operator-facing host sits behind a Caddy forward-auth gate – a valid Authentik session in the operators group is required before a request ever reaches the service, so having an account is not the same as having access. Vaultwarden and Listmonk rely on that gate exclusively; the services with sign-in of their own get it as a second lock on top. You don’t configure any of this – the CLI generates the right Caddyfile based on your component selection.
Backups run daily at 02:00 via a systemd timersystemd timerLinux’s built-in scheduler - it runs a task on a clock (here, the backup every night at 2 AM) without anyone having to be there.
. Every PostgreSQL database gets dumped, Vaultwarden’s SQLite database gets copied, and service data volumes get archived. Everything is compressed, encrypted, integrity-verified, then uploaded to Hetzner Object Storage with 30-day retention and automatic pruning – and the output includes a generated restore.sh so recovery is a script, not an archaeology project. The backup script uses a secure temp directory with trap-based cleanup, so even a failed backup doesn’t leave sensitive data on disk. And a monthly restore drill (the 5th, around 04:30) downloads the newest offsite backup and proves it actually restores – the first drill kicks off automatically right after your first successful upload, so you never sit on archives nothing has ever tested.
A weekly compliance monitor checks your Caddy configuration against a known-services list. If someone adds a new reverse proxy route – a new service that wasn’t part of the original deployment – the monitor detects it and sends an alert email with a compliance checklist. It’s a lightweight tripwire that keeps your infrastructure documentation honest as things evolve.
Compliance is built in
The stack treats the compliance paperwork as part of the deliverable.
There’s a compliance document that maps the deployed components to specific GDPR Article 32 and NIS2 Article 21 controls. Encryption in transit, MFA enforcement, centralized access control, audit logging, backup and recovery, network segmentation – each is documented with the specific technical measure in your stack that satisfies it.
CISO Assistant takes this further. The provisioning script creates entries for your deployed services as managed assets, registers your infrastructure vendors (Hetzner, Brevo) as suppliers with EU jurisdiction noted, and activates the compliance frameworks you selected during setup. When your first auditor asks “show me your asset inventory” or “where’s your supplier risk register,” you have a starting point that’s already populated with accurate data.
The documentation also includes incident response templates, CVE response SLAs (critical vulnerabilities within 24 hours, high within 7 days), a housekeeping calendar with weekly, monthly, quarterly, and annual tasks, and a subprocessor register that lists every external service with its EU jurisdiction and data processing purpose. This is the kind of documentation that takes weeks to write from scratch and that most startups don’t create until an auditor forces them to.
Who this is for
SOVRAK is for technical founders and small teams who want to move fast without outsourcing their infrastructure sovereignty. The ideal user is someone who’s comfortable with SSH and Docker but doesn’t want to spend weeks researching which identity provider integrates with which CI system and how to configure forward auth headers.
You need a single Ubuntu VM (Hetzner’s CX42 with 8 vCPU and 16 GB RAM is the recommended baseline, about €17/month at the time of writing – check Hetzner’s current pricing), a domain you control, a Brevo account for transactional email, and Hetzner Object Storage – every stack asks for both, because the encrypted nightly backups need somewhere offsite to go and the alerts need a relay (strictly, any S3-compatible object storage and any SMTP relay will do; Hetzner and Brevo are the tested defaults). The CLI handles the rest – dependency resolution, secret generation, configuration prompts, and file generation. Deploy with rsync and systemd, and you have a production-ready platform.
The CLI and the Erasix service are source-available under the Fair Core License: free to read, modify, and use internally, with each release converting to Apache-2.0 two years after it ships, and the SDK packages your own application links against are MIT. The components carry their own open-source or source-available licences (MIT for Gitea, AGPL-3.0 for CISO Assistant, Vaultwarden, and Listmonk, BSL for Outline). There’s no telemetry, no license keys, no phone-home, and no vendor lock-in beyond the infrastructure provider you choose – switching Hetzner for OVHcloud or any other EU provider is a DNS change and an rsync.
“We’ll figure out compliance later” is a perfectly good plan right up until an enterprise prospect sends over the security questionnaire. If you’re going to end up sovereign anyway, it’s cheaper to start there.
Edited 2026-07-30. Updated the monitoring and Erasix descriptions with how the stack handles personal data in logs: client IPs are truncated at the source and Loki’s 31-day retention auto-erases the rest, and the Erasix SDK gained a Fortibus.Sovereignty.Loki provider that applications can use to fold their own log lines into erasure and export.
Edited 2026-07-31. Corrected the licensing description: the CLI and the Erasix service are source-available under the Fair Core License (each release converts to Apache-2.0 after two years), not MIT; the MIT carve-out covers the SDK packages your own application links against. Also corrected the CISO Assistant description: the provisioning script runs automatically on first boot and seeds directly into its database (there is no spreadsheet import in community CISO Assistant), and CISO Assistant signs in through Authentik via its own generated OIDC client rather than relying on the forward-auth gate alone.
Edited 2026-07-31. The products now carry their working names: the stack is SOVRAK and the data-subject rights service is Erasix (the CLI’s own output still says “Sovereign Stack” for now). Also corrected the SSO description – the forward-auth gate fronts every operator host, not just Vaultwarden and Listmonk, which merely rely on it exclusively – added the newly published prometheus. host to the topology, noted the monthly restore drill, and clarified that Hetzner and Brevo are tested defaults for the object-storage and SMTP requirements, not the only options.