Hi all,
I am trying to find out if there is interest in a hosted Forgejo service with a strong emphasis on EU sovereignty and independence from big tech. Forgejo is an open-source Git hosting platform that I think is great and deserves wider use. For that reason, we will donate 5% of our plan revenue to the Forgejo project.
The plan is to cover what developers and small teams need:
- Forgejo for Git hosting
- Servers at Scaleway (a European cloud provider)
- CI/CD runners
- Dependency vulnerability alerts on every plan
- Daily backups
- Other essentials, as listed on our features page
Vault42 (that’s us) has no US parent company and uses only EU-based subprocessors, so your code stays outside US jurisdiction. ISO 27001 certification is a goal for later on.
The focus will be on private repositories, since Codeberg already serves open-source projects very well. There will also be a free plan for open source with unlimited public repositories, not to compete with Codeberg but to give people another option.
If this interests you, you can join the waitlist at vault42.eu.
Questions and suggestions are welcome in the comments or by DM.
Cheers,
Marijn from Vault42
Disclosure: I am the founder of Vault42.
Having european alternatives is great but honestly for private repos I’d rather just spin up a Forgejo instance myself on my own hardware.
While I’d like to spin my own hardware, I still have to pay for external service to punch through my ISP’s NAT and access my server from outside. I also have to buy external backups from someone and all this costs pile up and running my own server is prohibitively expensive compared to just using codeberg.
Ah, neither my office nor my home is plagued by cgnat. That would certainly make a difference in options.
And wireguard and duplicati/proxmox-backup don’t get you there?
You know the community: they’d love to help you set up any of those. ;-)
Was about to suggest something like Netbird (also uses Wireguard), which has free tier I believe. Also using that myself for some instances I don’t need public facing.
Atleast Netbird is European. Thanks!
Can wireguard alone let me access my servwr from outside the NAT without having an external server?
Does duplicati have free tier for external backups?
If by ISP NAT you mean you never have a unique external IP for your ISPs router then no, wireguard does nothing for you there.
Yes. Just don’t forget to never expose them publicly, those things are full of CVEs
I already do: Codeberg
I was going to say Codeberg is in Berlin, Germany. They also allow private.
Good luck to you, I hope the project goes well!
Hi FiniteBanjo,
Thanks for your reply and kindness :)
You are right that Codeberg does offer private repo’s but it’s under a pretty limiting set of rules, especially for commercial projects, which is more my aim. See https://docs.codeberg.org/getting-started/faq/#how-about-private-repositories?
[…] If you do not contribute to free/libre software (or if it is limited to your personal homepage), and we feel like you only abuse Codeberg for storing your commercial projects or media backups, we might get unhappy about that.
Codeberg is great for open source though. Vault42 is meant for the private and client work that falls outside their scope.
You’re not going to scale on Forgejo, or at least Codeberg isn’t managing it. Since AI scrapping has become rampant they are struggling with availability.
Good point. Codeberg did end up putting Anubis, a proof-of-work challenge, in front of their instance, and as far as I can tell their problems came mostly from AI crawlers rather than from Forgejo itself. A large public forge is exactly what those crawlers target.
Vault42 is aimed mainly at private repositories, which crawlers cannot reach, but our free tier does allow public repositories, so we are not immune. That part of the service needs the same protection, and we plan to handle it with:
- Rate limiting, with stricter limits for anonymous traffic
- Anubis or a similar proof-of-work proxy for anonymous visitors
- Restricting expensive operations such as archive downloads and blame views to signed-in users
Because most of our traffic will come from signed-in users working on private code, the exposure is much smaller than Codeberg’s, but it is certainly something to take seriously.
Thanks for pointing that out!
I’d stick to Codeberg. I have no problem open-sourcing large portions of my work in return for a few private repos, and I don’t use much of their disk-space either.
What I want is a federated Forgejo with strong moderation tools.
I’m a fan of federation and decentralisation too, when done well. It isn’t what we’re building, though. Vault42 is meant as a professional alternative for teams moving away from GitHub and other non-EU platforms, so our focus is on things like CI/CD with self-hosted runners and vulnerability alerting. Federation in Forgejo is still under development upstream; once it is stable, we will certainly look at enabling it.
I know it’s still in development. I still want it, though. And once it’s done, it would make a lot of sense for a company/org to hire hosting and administration of an instance just for them. A lot more professional to have your code on code.myorg.net/project than on any 3rd party site (whether it’s github, gitlab, codeberg, you name it).
deleted by creator
Thanks, that is useful to hear. Vault42 runs on Forgejo, so Forgejo Actions with self-hosted runners is supported out of the box: you can register your own runner for a single repository, for all of your personal repositories, or for an organisation, and your builds never touch our machines unless you want them to.
If you’d like to try it, there is a beta waitlist at https://vault42.eu/beta.
Y E S.
I think small open source commercial businesses would want this. Even if there’s overlap with Codeberg we need options for a healthy market. I hope you suceed and bookmarked for my own future hosting needs.
This is interesting, especially if you can customize it for game development. Most gamedevs are still using github as Codeberg doesn’t allow commercial projects (?). If you can integrate this with Godot, Bevy, Fyrox etc I’d say you have a good chance of finding users. I know EU studios like Larian are using Gitlab, but for indie devs who can’t self host, this could prove to be an alternative.
-
Are you hosting this on your hardware or using a host ?
-
I saw community governance on the site, that is great. Are you registered as a non-profit or PBC ? Being either of these’d give indie devs much more assurance
Hi, thanks for this reply, I love your ideas.
Being a home for indie game developers is definitely something I aspire to, because 1) I’m a hobby gamedev myself, and 2) I love indie games and the community.
The technical side is quite doable, since you can point your Forgejo runner at any image that builds games, and the same goes for Rust projects. Still, we could work together to find sensible, workable defaults if you’d like.
On your two questions:
- We use a French cloud provider called Scaleway, which is 100% European.
- “Community governed” on the site refers to Forgejo itself. I’ll make that clearer on the site. Vault42 is currently run by me as a self-employed sole trader registered in the Czech Republic, with help from a few freelancers. There are no investors and no parent company, in the US or anywhere else. It isn’t a non-profit, and a PBC is a US legal form, so that doesn’t apply here. Supporting Forgejo is part of the plan, though, which is why 5% of plan revenue goes to the project.
-
IMHO, it’s a complicated product-market fit. Most commercial clients don’t care where the money goes and are happy to use github with EU data residency. Open source projects have many free options and can’t afford paid solutions most of the time. The potential clients are pretty much just big, well funded open source projects that want to escape GIthub’s AI. There are some of them but I don’t know how many.
How is CI/CD going to look? I currently have many different Github workflows and they are the main thing keeping me from switching to a different platform; the issue is the ecosystem of third party workflows is gigantic, so a competitor ideally needs to be able to run them out of the box, or require only a minor refactor.
Hi! Thanks for your reply :)
This is exactly why I want to offer hosted CI/CD, so that EU GitHub users can actually make the switch. To be honest, I’m still working a lot of this out, and I can’t promise a seamless one-to-one transition from GitHub Actions to Forgejo Actions. They are very similar, but there are differences.
What I can say: Forgejo Actions uses nearly the same workflow syntax, and if a repository has no .forgejo/workflows folder, it reads your existing .github/workflows folder. Most third-party actions work too: common ones resolve by their usual name, and you can reference others by their full GitHub URL.
Hosted runners will offer a lean default image and a GitHub-compatible one, so most workflows should run unchanged or with a small change.
The biggest exception is actions that talk to GitHub itself, such as creating GitHub releases or commenting on pull requests. Those need a Forgejo alternative. There are a few smaller differences as well, such as artifact uploads using Forgejo’s own version of the upload-artifact action.
I want to make this transition as smooth as possible, and for complex setups like yours I’m happy to help directly.
Sounds exciting, I’d be happy to try it out!
