Buy European

Exactly. Since Vault42's market appears to be corporate clients, its sole value proposition then is to handle the infrastructure a company would have maintain otherwise, is it?

While I'd like to spin my own hardware, I still have to pay for external service to punch through my ISP's NAT and access my server from outside. I also have to buy external backups from someone and all this costs pile up and running my own server is prohibitively expensive compared to just using codeberg.

That's what I do as well. There's interest (in a Github alternative) from my side and that's why I already spun up my own Forgejo instance. So I'm fine. I suppose the perspective here is skewed, though. There's probably also people who don't selfhost.

Yes. Just don't forget to never expose them publicly, those things are full of CVEs

Hi FiniteBanjo,

Thanks for your reply and kindness :)

You are right that Codeberg does offer private repo's but it's under a pretty limiting set of rules, especially for commercial projects, which is more my aim. See https://docs.codeberg.org/getting-started/faq/#how-about-private-repositories?

[...] If you do not contribute to free/libre software (or if it is limited to your personal homepage), and we feel like you only abuse Codeberg for storing your commercial projects or media backups, we might get unhappy about that.

Codeberg is great for open source though. Vault42 is meant for the private and client work that falls outside their scope.

I’m a fan of federation and decentralisation too, when done well. It isn’t what we’re building, though. Vault42 is meant as a professional alternative for teams moving away from GitHub and other non-EU platforms, so our focus is on things like CI/CD with self-hosted runners and vulnerability alerting. Federation in Forgejo is still under development upstream; once it is stable, we will certainly look at enabling it.

Forgejo is developing ForgeFed though

Thanks, that is useful to hear. Vault42 runs on Forgejo, so Forgejo Actions with self-hosted runners is supported out of the box: you can register your own runner for a single repository, for all of your personal repositories, or for an organisation, and your builds never touch our machines unless you want them to.

If you’d like to try it, there is a beta waitlist at https://vault42.eu/beta.

If you don't mind me asking some other questions about this: If you are not comfortable stating this publicly you can also mail me at marijn@vault42.eu

• What did this DORA addendum from your Git host actually needed to contain?

• Would your company have been willing to go with a smaller company that would be willing to sign it? If not, why not?

• What else did your vendor assessment require beyond this addendum?

This is really valuable information. For financial customers, being able to sign a DORA addendum makes a lot of sense, and I'll look into it more closely. There are probably similar regulations in other industries that could be relevant too? ISO 27001 certification is already on the roadmap.

Thanks a lot, I really appreciate it!

Hi! Thanks for your reply :)

This is exactly why I want to offer hosted CI/CD, so that EU GitHub users can actually make the switch. To be honest, I'm still working a lot of this out, and I can't promise a seamless one-to-one transition from GitHub Actions to Forgejo Actions. They are very similar, but there are differences.

What I can say: Forgejo Actions uses nearly the same workflow syntax, and if a repository has no .forgejo/workflows folder, it reads your existing .github/workflows folder. Most third-party actions work too: common ones resolve by their usual name, and you can reference others by their full GitHub URL.

Hosted runners will offer a lean default image and a GitHub-compatible one, so most workflows should run unchanged or with a small change.

The biggest exception is actions that talk to GitHub itself, such as creating GitHub releases or commenting on pull requests. Those need a Forgejo alternative. There are a few smaller differences as well, such as artifact uploads using Forgejo's own version of the upload-artifact action.

I want to make this transition as smooth as possible, and for complex setups like yours I'm happy to help directly.

Thanks, these are fair questions and valid concerns, and you're right that the site doesn't cover them properly yet.

The smaller plans will run on a shared platform aimed at freelancers and small teams. For companies with requirements like yours, there will be an Enterprise plan with an isolated Forgejo instance on dedicated infrastructure. That's where most of your points come in:

• Custom domains: will be possible on a dedicated instance.
• Identity provider: Forgejo supports OpenID Connect and LDAP, so a dedicated instance can be connected to your own identity provider.
• Customisation and limits: look and feel, repository and storage limits, and other settings will be configurable per dedicated instance.
• Internal systems: webhooks and the API cover most tools, and Forgejo can link to an external wiki or issue tracker such as Jira. For systems inside your network, such as Artifactory, you'll be able to run Forgejo runners on your own infrastructure, so CI can reach them without exposing them to the internet.
• Data separation: Enterprise customers will get their own instance, so their data won't be shared with other customers.

I agree that hosting is the easy part and integration is the hard part, this is also the part that makes it worth doing for me :).

Hi, thanks for this reply, I love your ideas.

Being a home for indie game developers is definitely something I aspire to, because 1) I'm a hobby gamedev myself, and 2) I love indie games and the community.

The technical side is quite doable, since you can point your Forgejo runner at any image that builds games, and the same goes for Rust projects. Still, we could work together to find sensible, workable defaults if you'd like.

On your two questions:

1. We use a French cloud provider called Scaleway, which is 100% European.
2. "Community governed" on the site refers to Forgejo itself. I'll make that clearer on the site. Vault42 is currently run by me as a self-employed sole trader registered in the Czech Republic, with help from a few freelancers. There are no investors and no parent company, in the US or anywhere else. It isn't a non-profit, and a PBC is a US legal form, so that doesn't apply here. Supporting Forgejo is part of the plan, though, which is why 5% of plan revenue goes to the project.