Le Panthéon de la Souveraineté

Infrastructure cloud modulaire, redondante et 100% souveraine pour s'affranchir des GAFAM. Guides techniques, architecture Zero-Trust et chiffrement interne (DoT/DoH)

This project was born from a need for total sovereignty and follows an iterative evolution:

• Context: An infrastructure hosted mainly in Switzerland (Infomaniak), whose data is replicated in encrypted form on two secondary sites in Germany and Finland (Hetzner). No data rests on a single site.
• v1.0 (Foundations): Definition of the Private Network and Perimeter Firewall (HS-01 & HS-02). Foundation acquired. Servers communicate over the private network, but their resolution (DNS) queries can still transit in clear text.
• v1.1 (Current - Server Sovereignty): Native integration of DoT (DNS-over-TLS). Now, each server (like VULCAIN) encrypts its own DNS queries (updates, service resolution) to the AEGIS foundation. No server talks to DNS in clear text anymore, even on the private network.
• Under Consideration (mTLS): Study of a major hardening via mTLS (Mutual TLS) to authenticate services between each other. This track is still being studied and does not yet have an assigned version number.

2. Author Profile & Transparency

I am not a degreed IT professional. This project is the fruit of a passion for system administration, built through self-training over the past 5 years.

• Risk of error: Although I scrupulously rely on official documentation, I am not exempt from mistakes in understanding or interpretation.
• AI Assistance (EURIA & PROMÉTHÉE Duality):
  • Currently: EURIA (Infomaniak) handles both documentation writing and technical assistance for commands and architecture.
  • Future (PROMÉTHÉE Project): A dedicated local AI will take over purely technical aspects and sensitive automation, while Euria will focus on documentation and methodology.
  • Note: Every command is human-verified.
• Ethical Posture: Immediate abandonment of any tool whose privacy policy is questionable.

3. Project Status & Warning

This project is in the active construction phase (v1.1).

• Documentation: Guides are written as the real deployment progresses.
• Service status:
  • HS-01 (Private Network): 🚧 FINALIZATION (D-4). The network is already operational in production; the written guide is coming within 96 hours.
  • HS-02 (Firewall): ✅ VALIDATED. Rule matrix v1.1 corrected (DNS closed inbound, ICMP outbound blocked).
  • HS-03 (Gold Image): ✅ VALIDATED. Ready for creating the reference snapshot.
  • VULCAIN: Being deployed (Priority #1). Will be configured to use DoT toward AEGIS.
  • AEGIS: DoT/DoH architecture defined, ready for deployment.
  • Backups (ARK): Multi-DC architecture (Switzerland, Germany, Finland) validated in the specs, being deployed.
• 🛑 WARNING: Do not deploy anything in production without validating each step in a test environment.

4. Limitation of Liability

Educational and personal project. The security of your data and the backup strategy are your full responsibility.

📜 Philosophy & Objectives

Demonstrate that it is possible to build a redundant, end-to-end encrypted and independent infrastructure.

The 3 Fundamental Pillars (v1.1):

1. Sovereignty & Redundancy: Main hosting in Switzerland (Infomaniak) with backup replication in Germany and Finland (Hetzner).
2. Security by Design (Server Encryption):
   • Current (v1.1): The servers themselves encrypt their DNS queries via the DoT (DNS-over-TLS) protocol toward AEGIS.
   • Flow Rule: Any non-essential outbound flow is strictly blocked by the firewall OR filtered at the DNS level.
   • Future (mTLS Consideration): Potential implementation of mutual certificate-based authentication.
3. Logical Deployment Order: Private Network → Entry Point (VULCAIN) → DNS Foundation (AEGIS) → Business Services.

🤝 The Assumed Trusted Third Parties

🗺️ Project Architecture (The 12 Deities)

🔍 Evolution Focus: From DoT to mTLS

• Version 1.1 (DoT): Each server encrypts its DNS queries toward AEGIS.
• Future Consideration (mTLS): Mutual certificate-based authentication for total Zero-Trust.

🧩 "Lego" Philosophy: Modularity & Universality

• 🏗️ Special Editions (Cloud-Specific): The foundation guides (Network, Firewall, Image) are designed specifically for the Public Cloud.
• 🌍 Universality of Deities: Once the foundation is in place, the installation guides are compatible with Public Cloud, VPS and Local.

The construction order (v1.1):

1. Network Foundation (HS-01): The invisible foundation (finally in its place!).
2. Firewall (HS-02): The walls and the reinforced door.
3. Gold Image (HS-03): The secure system mold.
4. Services: Deployed and connected.

🤡 Author's note on the reordering: You may have noticed that "Special Edition #1" took time to arrive while "#2" was already there. No, it's not a security flaw, it's an experimental feature called "Deployment through the window". Like a good passionate architect, I started by painting the shutters (Firewall) and choosing the furniture (Gold Image) before pouring the foundations (Network). It's the obvious that is often invisible... until you realize you can't lay the walls. 🤦‍♂️ Rest assured: the network was already set up behind the scenes! Guide HS-01 just arrives to explain how I poured those foundations that I had laid on autopilot.

📚 Documentation & Deployment Guides

🗂️ Documentation Structure

The documentation is organized in the docs/ folder:

• 📂 00_HORS-SERIES : Cross-cutting guides Specific to Public Cloud.

  • ⏳ Coming soon: HS-01: Setting Up the Private Network (The real foundation!)
  • ✅ Available: HS-02: The Perimeter Firewall (The fortress walls)
  • ✅ Available: HS-03: Creating the Debian Gold Image (The system mold)

  🔄 Note on the "Crossover" of the Special Editions: You may have noticed that the numbers have moved? That's normal (and owned up to!). Initially, the Firewall was HS-01 and the Network HS-02 (forgotten). We realized that it's difficult to filter a network that doesn't exist yet! 🤦‍♂️ So we carried out a complete restructuring to respect the logical deployment order: 1. Network (HS-01) → 2. Firewall (HS-02) → 3. Image (HS-03). If you had followed the old numbering, our apologies! It is now fixed and consistent.

• 📂 01_DIVINITES : Specific deployment guides (Compatible with Cloud, VPS & Local).

• 📂 99_COMMUN : Shared resources.

🚀 Where to start? (Quick Start)

1. Read this README to understand the v1.1 architecture.
2. Deploy the security foundation (In order!):
   • 📄 Special Edition #1: The Private Network (The foundation).
   • 📄 Special Edition #2: The Perimeter Firewall (The security).
   • 📄 Special Edition #3: The Debian Gold Image (The system).
3. Watch for upcoming publications:
   • 🔥 VULCAIN Guide – Being written.
   • 🛡️ AEGIS Guide – Coming soon.

💡 Tip: Star (⭐) this repository to be notified of updates.

💰 Economic Model & Hosting

• Main Hosting Provider: Infomaniak (Switzerland).

• Secondary Hosting Provider (Backup): Hetzner (Germany & Finland).

• Redundancy: 3 distinct datacenters. Encrypted backups (AES-256).

• Target Cost: €200~€300/month.

• Project support:

  • ☁️ Infomaniak Public Cloud
  • 🖥️ Infomaniak VPS
  • 📧 kSuite (including kDrive & Euria)
  • ℹ️ Infomaniak Official Website

🚀 Roadmap (v1.1 - Construction)

• Phase 0: Design & Tools
• Reorganization of the Special Editions – Correction of the logical order (Network → Firewall → Image).
• Publication of HS-02 & HS-03 – Firewall and Gold Image.
• Publication of HS-01 – Private Network (The missing foundation).
• Phase 1: VULCAIN – Proxy deployment.
• Phase 2: AEGIS – Deployment of the DNS foundation.
• Phase 3: ARK & Data – Multi-DC backups.
• mTLS Consideration – Implementation study.

🤝 Contributing & License

Licenses:

• Content (Guides): CC BY-SA 4.0
• Cited Software: Each deity respects the license of its constituent software.

"Digital sovereignty is not a product you buy, it is an architecture you build. Sometimes, you have to move the bricks so that the edifice can stand."