Blog
How an EU-sovereign platform gets built — the decisions, the trade-offs, and the occasional dead end.
23 August 2026
Letting a Merchant of Record handle EU VAT while keeping the entitlement model in your own database — and the production bug that proved why that split matters.
19 August 2026
Taking the four-clause contract from theory to a real product running in production — one pull request, and the friction list from doing it the first time.
16 August 2026
Rebuilding an entire self-hosted platform from nothing but an offline secret list, two git repos and a bucket — measured end to end at 1 h 23 m 39 s.
12 August 2026
Four backup mechanisms, one bucket, and a table of what each one does not cover — plus a restore day with real timings and the storage bug that made file backups silently impossible.
9 August 2026
Files and passwords for a small company, self-hosted behind one sign-on — including the security property that looks like a broken feature until you understand it.
5 August 2026
One OIDC provider for every app on the platform, with the realm itself declared in git — and why the admin console being read-only by convention is the whole point.
2 August 2026
CloudNativePG on a single cheap box, backed up to EU object storage with the Barman Cloud Plugin — and the two restore drills, with timings, that decide whether any of it counted.
29 July 2026
A runtime secret store on your own cluster, bridged into Kubernetes by External Secrets — and the two secrets that can never live in it, written down as an exhaustive list.
26 July 2026
How this page got here: a commit, a multi-arch image, and a GitOps reconcile — with no hands on the cluster.
22 July 2026
A reproducible single-node Talos Linux cluster on a cheap Hetzner box in the EU — no SSH, no cloud-init, nothing clicked in a console.
19 July 2026
Portability isn't a migration tool you bolt on later — it's a four-clause contract you commit to on day one. Here's the exact interface the whole platform runs on.
15 July 2026
Most 'EU cloud' is US infrastructure with a German postal code. I'm building a managed SaaS platform that's sovereign by jurisdiction, not marketing — in the open.