Product · In development
SOVRAK
A generated Docker Compose stack — identity, secrets, source control, CI, edge — configured to work together on hardware you rent in Europe. One command. No Kubernetes.
You did not choose a hyperscaler. You chose the fastest route to a working deployment, and a hyperscaler happened to be it. Years on, the bill has a life of its own, the managed services you leaned on have quietly become the reason you cannot leave, and a prospect’s procurement team is asking about data residency in terms you cannot answer without a lawyer.
The alternative has always been worse. Self-hosting means becoming a platform engineer: reverse proxies, certificate renewal, single sign-on between services that each authenticate differently, a CI runner, backups you actually test. That is a job you cannot fill, so you stay.
SOVRAK is the assembly work, already done.
stack.menu
edge
Caddy, with automatic Let's Encrypt certificates. Required by everything that serves a web UI.
identity
Authentik — one login, MFA, and centralised user management, with WebAuthn passkeys encouraged over anything phishable.
secrets
Vaultwarden, Bitwarden-compatible, for the operational credentials your team shares — not for your application's own secrets.
source + ci
Gitea, which doubles as the OAuth2 provider for Woodpecker; pipelines run from Gitea webhooks on the same machine.
observability
Prometheus, Loki and Grafana, with Alloy shipping every container's logs to Loki without per-service wiring.
backups
Nightly encrypted backups to EU object storage — and a monthly restore drill that proves the newest one actually restores, not just that it uploaded.
compliance
CISO Assistant for governance and risk — GDPR, NIS2, ISO 27001, DORA, BIO2 — pre-loaded with the frameworks you select.
rights
Erasix — erasure, export, consent, retention, breach tooling, a tamper-evident audit trail, and a self-service privacy portal your users reach directly. How that works.
data
Each selected service brings its own Postgres, internal to that service. None of them is a database for your application to build on — that one is on the roadmap below.
The output is plain Docker Compose you can read, diff, and edit. There is no proprietary runtime and nothing phones home. If you stop using the tool tomorrow, the stack it generated keeps running.
Why SOVRAK exists
I did not set out to build infrastructure. I was building something else — a product whose market is specifically European — and the further I got, the more of my time went to a question that had nothing to do with the product: where the data was allowed to live, how do I honor GDPR requests, and who could be compelled to hand it over.
The hard part was never understanding the rules — it was that nothing on offer fitted a company my size. Everything assumed either a platform team I did not have or a compliance budget I was not going to spend, and the gap between those two answers is where most startups quietly end up.
So I worked out the pieces myself — identity, source control, CI, backups, the rights machinery — and assembled them until the thing ran. Then I started hearing the same story from other founders: the same gap, the same dead end, the same weeks lost to plumbing that was never the point. Bundling up what I had already built and generating it for someone else was the obvious next step. That part took a couple of months.
Finding a name that was both available and fitting took, embarrassingly, rather longer.
SOVRAK is a backronym, and not a subtle one: a Self-Owned, Vendor-Replaceable Application Kit. Self-owned, because the machine is rented in your name and everything on it runs in your account — I hold no keys. Vendor-replaceable, because every piece on the menu above is open source and swappable, including the piece that is me.
What this is not
It does not remove operational responsibility — it removes the weeks of assembly before anything runs. You still own the server and the decision to restore from backup at three in the morning.
If you have a working platform function and a Kubernetes investment you are happy with, do not migrate. If you need managed services with contractual availability guarantees, this is the wrong shape of thing. Saying so costs me a few enquiries and saves us both a bad quarter.
European jurisdiction, end to end
It runs on hardware you rent from an EU provider, in your own account. There is no operator in the chain — including me — who could be compelled by a foreign jurisdiction to reach into it.
Open, portable foundations
Built on open-source technology, so there is no lock-in — you can always take your workloads and leave.
Privacy by architecture
Encryption and data minimisation are structural decisions, not compliance checkboxes added later.
Boring, in the good way
No proprietary runtime and no surprise bills — you pay your hosting provider directly, and every choice in the stack is made for reliability over novelty.
What's next
On the roadmap
Everything on the menu above is built. These are the pieces that are not — in progress rather than available, and documented as they happen over in Insights.
Next up
A database for your own application
Each selected service brings its own database, but none of those is yours to build on. Postgres for your application gets its own deployable service — a hardened container on an internal network, with metrics, backups, and a least-privilege role wired in from the start — rather than something you bolt on afterwards.
Next up
A public status page
Metrics, logs, and dashboards already ship. What is missing is the outward-facing half — so the answer to "is it down?" isn't an email to me.
Planning
Team messaging tool
Real-time communications between your team members, data completely in your control.
SOVRAK is a working name, pending trademark clearance.
Interested in SOVRAK?
Get in touch at ryan@fortibus-consulting.com — I'm happy to talk.