01
Compute
-
Kubernetes -
Proxmox VE -
Docker
Tech Stack
The stack we build on
Grouped by layer. Every component is open, auditable and exchangeable, with a documented interface and a migration path.
02
Automation
-
Terraform -
OpenTofu -
Ansible
03
Delivery
-
GitLab -
Argo CD -
Helm
04
Identity
-
Keycloak -
Authentik
05
Network
-
Cilium -
Traefik -
Nginx
06
Storage & Data
-
PostgreSQL -
MinIO -
Valkey -
OpenSearch
07
Observability
-
Prometheus -
Grafana -
Loki
08
Collaboration
-
Nextcloud
Migration paths
What we build is open source only. What we replace usually is not — which is exactly why we know it. An exit only works when both sides are familiar.
- Existing Microsoft Entra ID Sovereign target KeycloakAuthentik
- Existing Microsoft 365 Sovereign target NextcloudCollaboraOnlyOffice
- Existing GitHub ActionsAzure DevOps Sovereign target GitLab CI
- Existing AWS RDS Sovereign target PostgreSQL
- Existing VMware vSphere Sovereign target Proxmox VE
- Existing Veeam Sovereign target ResticBorg
- Existing Elasticsearch Sovereign target OpenSearch
- Kubernetes
- Proxmox VE
- Docker
- Terraform
- OpenTofu
- Ansible
- GitLab
- Argo CD
- Helm
- Keycloak
- Authentik
- Cilium
- Traefik
- Nginx
- PostgreSQL
- MinIO
- Valkey
- OpenSearch
- Prometheus
- Grafana
- Loki
- Nextcloud
Hyperscaler setup vs. Klackwerk platform
| Criterion | Typical hyperscaler setup | Klackwerk platform |
|---|---|---|
| Data location | US-controlled provider, third-country transfer risk | Your data centre or EU provider with C5 / ISO 27001 |
| Identity | Entra ID, Okta or Auth0 (proprietary SSO) | Keycloak or Authentik, OIDC / SAML, passkeys |
| Storage & database | Managed DBaaS and storage quirks you cannot leave | PostgreSQL, the S3 API, MinIO or Ceph (exchangeable) |
| Provisioning | Console clicks plus partial automation | Infrastructure as code, GitOps, four-eyes review |
| Telemetry | Vendor telemetry, limited insight into data flows | Prometheus, Loki, Grafana (no external telemetry) |
| Exit path | Migration cost grows with every proprietary service | Every building block exchangeable, migration path included |
Ready to map your dependencies?
A short call is enough to start. No brief required. If it fits, a sovereignty assessment follows, with a fixed scope: at the end you know which dependency goes first, what it costs and how long it takes.