Field notes from
the sovereign stack

Run a self-hosted LLM for coding: Continue and Tabby wired to an open-weight code model served on vLLM, so your proprietary source code never reaches a vendor.

How a covered entity runs a HIPAA-compliant LLM on-premises: PHI never leaves your perimeter, no third-party BAA to manage, every inference logged for audit.

Kubernetes runtime threat detection with eBPF: Falco for broad MITRE ATT&CK detection, Tetragon for in-kernel enforcement, alerts piped to a self-hosted SIEM.

Own your identity plane: a trust-model decision matrix comparing Keycloak, Authentik, and Zitadel as self-hosted SSO — the engineering exit from Okta.

A self-hosted CI/CD GitHub Actions alternative: Forgejo for git, Woodpecker for pipelines, Zot for OCI artifacts — the whole delivery chain as owned infrastructure.

After MinIO archived its open-source edition: a framework for choosing self-hosted S3-compatible object storage by tenancy, throughput, and jurisdiction.

A sovereign DR architecture for Kubernetes — Velero plus CSI data-mover for apps and volumes, etcd snapshots for cluster state, cross-region restore to a standby cluster, and restore drills that turn RPO/RTO from a promise into evidence.

How AMD SEV-SNP, Intel TDX, and Confidential Containers (CoCo/Kata) protect data-in-use on Kubernetes — and how remote attestation gates key release so workloads only run on verified hardware.

An engineering guide to running production PostgreSQL on Kubernetes with CloudNativePG: HA streaming replication, WAL archiving and PITR to your own object store, automated failover, and exit from managed-DB lock-in.