If you don’t mind me asking some other questions about this: If you are not comfortable stating this publicly you can also mail me at marijn@vault42.eu

• What did this DORA addendum from your Git host actually needed to contain?

• Would your company have been willing to go with a smaller company that would be willing to sign it? If not, why not?

• What else did your vendor assessment require beyond this addendum?

Good point. Codeberg did end up putting Anubis, a proof-of-work challenge, in front of their instance, and as far as I can tell their problems came mostly from AI crawlers rather than from Forgejo itself. A large public forge is exactly what those crawlers target.

Vault42 is aimed mainly at private repositories, which crawlers cannot reach, but our free tier does allow public repositories, so we are not immune. That part of the service needs the same protection, and we plan to handle it with:

• Rate limiting, with stricter limits for anonymous traffic
• Anubis or a similar proof-of-work proxy for anonymous visitors
• Restricting expensive operations such as archive downloads and blame views to signed-in users

Because most of our traffic will come from signed-in users working on private code, the exposure is much smaller than Codeberg’s, but it is certainly something to take seriously.

Thanks for pointing that out!

That is a good tip! I will look into that!

Hi,

I put up an enterprise page with more details: https://vault42.eu/enterprise

It’s also referred to from the main page several times. Let me know if this satisfies your needs!

Cheers :)

Hi! Thanks for your reply :)

This is exactly why I want to offer hosted CI/CD, so that EU GitHub users can actually make the switch. To be honest, I’m still working a lot of this out, and I can’t promise a seamless one-to-one transition from GitHub Actions to Forgejo Actions. They are very similar, but there are differences.

What I can say: Forgejo Actions uses nearly the same workflow syntax, and if a repository has no .forgejo/workflows folder, it reads your existing .github/workflows folder. Most third-party actions work too: common ones resolve by their usual name, and you can reference others by their full GitHub URL.

Hosted runners will offer a lean default image and a GitHub-compatible one, so most workflows should run unchanged or with a small change.

The biggest exception is actions that talk to GitHub itself, such as creating GitHub releases or commenting on pull requests. Those need a Forgejo alternative. There are a few smaller differences as well, such as artifact uploads using Forgejo’s own version of the upload-artifact action.

I want to make this transition as smooth as possible, and for complex setups like yours I’m happy to help directly.

I’m a fan of federation and decentralisation too, when done well. It isn’t what we’re building, though. Vault42 is meant as a professional alternative for teams moving away from GitHub and other non-EU platforms, so our focus is on things like CI/CD with self-hosted runners and vulnerability alerting. Federation in Forgejo is still under development upstream; once it is stable, we will certainly look at enabling it.

Thanks, that is useful to hear. Vault42 runs on Forgejo, so Forgejo Actions with self-hosted runners is supported out of the box: you can register your own runner for a single repository, for all of your personal repositories, or for an organisation, and your builds never touch our machines unless you want them to.

If you’d like to try it, there is a beta waitlist at https://vault42.eu/beta.

As is stated in the pricing card of the enterprise, the plan starts at a certain amount, and is tailored to the needs of the customer. So it really depends on what the needs of the enterprise customer will be.

And yes, will put the info on the website, thanks for suggestions! These kind of questions really help clarify the offerings before we begin :)

Much appreciated!

Thanks, these are fair questions and valid concerns, and you’re right that the site doesn’t cover them properly yet.

The smaller plans will run on a shared platform aimed at freelancers and small teams. For companies with requirements like yours, there will be an Enterprise plan with an isolated Forgejo instance on dedicated infrastructure. That’s where most of your points come in:

• Custom domains: will be possible on a dedicated instance.
• Identity provider: Forgejo supports OpenID Connect and LDAP, so a dedicated instance can be connected to your own identity provider.
• Customisation and limits: look and feel, repository and storage limits, and other settings will be configurable per dedicated instance.
• Internal systems: webhooks and the API cover most tools, and Forgejo can link to an external wiki or issue tracker such as Jira. For systems inside your network, such as Artifactory, you’ll be able to run Forgejo runners on your own infrastructure, so CI can reach them without exposing them to the internet.
• Data separation: Enterprise customers will get their own instance, so their data won’t be shared with other customers.

I agree that hosting is the easy part and integration is the hard part, this is also the part that makes it worth doing for me :).

This is really valuable information. For financial customers, being able to sign a DORA addendum makes a lot of sense, and I’ll look into it more closely. There are probably similar regulations in other industries that could be relevant too? ISO 27001 certification is already on the roadmap.

Thanks a lot, I really appreciate it!

Was about to suggest something like Netbird (also uses Wireguard), which has free tier I believe. Also using that myself for some instances I don’t need public facing.

I really get that sentiment, because I share it too, to a certain extent. Putting an EU sovereignty sticker on a product that is still tied, one way or another, to the things it claims to reject is basically false advertising, if you ask me.

I care about EU sovereignty and independence from big tech because I want technology to do good, rather than harm the environment and people. That is the reason I started this project and why I’m testing whether others care about it as much as I do, and I’m glad to see that you are one of them.

Concretely: Vault42 has no investors and no parent company. It is run by me as a sole trader in the Czech Republic, and all subprocessors are EU-based. US legal orders such as the CLOUD Act have no direct reach. Anyone wanting data would have to go through Czech and EU law, as with any other European company. And nobody at Vault42 looks into private repositories, for competitors or anyone else.

Sovereignty really is a spectrum, and it has to cover the whole chain of operation, continuously. Keeping that up will probably be the biggest task in running this project. I intend to do it in a way that lets people like you and me feel safe, so that technology serves us rather than using us.

I’m curious: what would you need to see from a product like this before you’d trust it with your code?

Hi, thanks for this reply, I love your ideas.

Being a home for indie game developers is definitely something I aspire to, because 1) I’m a hobby gamedev myself, and 2) I love indie games and the community.

The technical side is quite doable, since you can point your Forgejo runner at any image that builds games, and the same goes for Rust projects. Still, we could work together to find sensible, workable defaults if you’d like.

On your two questions:

1. We use a French cloud provider called Scaleway, which is 100% European.
2. “Community governed” on the site refers to Forgejo itself. I’ll make that clearer on the site. Vault42 is currently run by me as a self-employed sole trader registered in the Czech Republic, with help from a few freelancers. There are no investors and no parent company, in the US or anywhere else. It isn’t a non-profit, and a PBC is a US legal form, so that doesn’t apply here. Supporting Forgejo is part of the plan, though, which is why 5% of plan revenue goes to the project.

Pretty much and by large, yes, compared with self-hosting: we run the servers, upgrades, backups and CI. Compared with GitHub or GitLab.com, the difference is jurisdiction: no US parent company, and most importantly, no Cloud Act, and only EU subprocessors.

Vault42 is meant for people who want both, for mainly freelancers, small agencies and small teams without anyone to spare for running such infrastructure.

Hi FiniteBanjo,

Thanks for your reply and kindness :)

You are right that Codeberg does offer private repo’s but it’s under a pretty limiting set of rules, especially for commercial projects, which is more my aim. See https://docs.codeberg.org/getting-started/faq/#how-about-private-repositories?

[…] If you do not contribute to free/libre software (or if it is limited to your personal homepage), and we feel like you only abuse Codeberg for storing your commercial projects or media backups, we might get unhappy about that.

Codeberg is great for open source though. Vault42 is meant for the private and client work that falls outside their scope.

*was given