schroeder-sys/pantheon-souveraineteInfrastructure cloud modulaire, redondante et 100% souveraine pour s'affranchir des GAFAM. Guides techniques, architecture Zero-Trust et chiffrement interne (DoT/DoH)
> 🏠 **Developed on:** [GitLab](https://gitlab.com/schroeder-sys/pantheon-souverainete) · 🪞 **Mirror:** [GitHub](https://github.com/schroeder-sys/pantheon-souverainete) · 🌐 **Website:** [pantheon-souverainete.eu](https://pantheon-souverainete.eu) # 🏛️ The Pantheon of Sovereignty > **A 100% sovereign, redundant and secure cloud infrastructure, designed to break free entirely from the GAFAM.** > *Version 2.1.0-alpha — Full structural overhaul. Starting from scratch.* [](#) [](#) [](LICENSE) [](#) [](https://pantheon-souverainete.eu) --- ## 📋 Table of Contents 1. [A word about the silence](#-un-mot-sur-le-silence-2-mois) 2. [Philosophy & Methodology](#-philosophie--méthodologie) 3. [Architecture (12 Deities)](#-architecture-les-12-divinités) 4. [Trust Tiers & Dependencies](#-tiers-de-confiance--dépendances) 5. [Affiliate Links](#-liens-daffiliation-infomaniak) 6. [Documentation & Guides](#-documentation--guides-de-déploiement) 7. [Prerequisites & Contacts](#-pré-requis--contacts) 8. [Roadmap](#-roadmap-v210-alpha) 9. [Licenses](#-licences) --- ## 🙏 A word about the silence (2 months) **I owe you an apology.** The project has not progressed publicly over the past 2 months. **The truth:** it was not an abandonment. I worked **under the radar** on a complete structural overhaul. V1.x had shaky foundations, so I made the decision to **start over from a blank page** rather than patch things up. **Concrete proof that the project is alive:** the showcase website is online ([pantheon-souverainete.eu](https://pantheon-souverainete.eu)). **Lesson learned:** I no longer promise specific dates. The guides will arrive "when they're ready". --- ## 🧠 Philosophy & Methodology ### Versioning & History > **Important note:** The earlier versions (1.0.0, 1.1.0) were alphas before the suffix was formally adopted. **No stable version has ever been released** — everything is in alpha. | Version | Status | Description | |---------|--------|-------------| | **v1.x** | ❌ Outdated | Initial architecture, guides published as they went | | **v2.1.0-alpha** | 🚧 In progress | **Full structural overhaul**. Starting from scratch. | ### 🤔 Philosophy on Forks **Recurring question:** *"Why do you use [X] rather than its fork [Y], which is more popular in the self-hosted community?"* **My answer:** I deliberately limit the use of forks. A fork creates a **structural lag** in updates relative to the upstream project, which can introduce security vulnerabilities or incompatibilities. **I only favour a fork if it brings a SIGNIFICANT gain in:** - ✅ **Security** (audited code, vulnerabilities fixed faster) - ✅ **Privacy** (telemetry removed, privacy-first features) **In all other cases: I stick with the upstream project.** #### Example 1: Debian > Ubuntu | Criterion | Debian | Ubuntu | |---------|--------|--------| | **Origin** | Source | Fork of Debian | | **Stability** | ✅ **Rock-solid** (rigorous testing) | ⚠️ Sometimes regressions | | **Security patches** | ✅ **Direct** (Debian Security team) | ⚠️ Delay (Canonical has to merge) | | **Philosophy** | Community-driven, sober | Commercial, "user-friendly" | **Why Debian?** > *"We can't afford to wait for a patch on the system itself. It's a matter of security and stability."* --- #### Example 2: AmneziaWG > WireGuard (kernel) | Critère | WireGuard | AmneziaWG | |---------|-----------|-----------| | **Origin** | Source protocol | **WireGuard kernel fork** | | **Obfuscation** | ❌ No | ✅ **Native (anti-DPI)** | | **Confidentiality** | Excellent | ✅ **Even better** | | **Collaboration** | — | ✅ **Works with the WireGuard team** | **Why AmneziaWG?** > *"A deliberate fork because of the significant gain in confidentiality (anti-DPI obfuscation). Moreover, the Amnezia team works closely with WireGuard — it's not a 'wild' fork."* --- #### Example 3: Bitwarden > Vaultwarden | Critère | Bitwarden (official) | Vaultwarden (fork) | |---------|---------------------|-------------------| | **Origin** | Source project | Rust fork (lightweight) | | **Clients** | ✅ **Official** | ⚠️ **Uses Bitwarden clients** | | **Compatibility** | ✅ **Guaranteed** | ⚠️ **Incompatibility windows** | | **Synchronized updates** | ✅ Yes | ❌ No (possible lag) | **Why Bitwarden and not Vaultwarden?** > *"Vaultwarden itself states that there may be incompatibility windows where the server is inaccessible to official Bitwarden clients. Beyond security, there is a real compatibility issue. I prefer the official version."* --- **In summary:** - ✅ **Debian** (source) > Ubuntu (fork) — System stability & security - ✅ **AmneziaWG** (fork) > WireGuard — Confidentiality gain (obfuscation) - ✅ **Bitwarden** (source) > Vaultwarden (fork) — Compatibility & security --- ### Hosting & Sovereignty * **Primary:** Infomaniak (**Switzerland**) — Data in Switzerland, signed DPA, genuine environmental commitment * **Backups:** Hetzner (**Germany** & **Finland**) — Cold storage replicated across 2 DCs * **Golden rule:** No data rests on a single site. ### Can I use V1 while waiting for V2.1? **Technically:** Yes, the HS-02 (Firewall) and HS-03 (Gold Image) guides are technically valid. **In practice:** ❌ **No, it is not recommended.** **Why?** * Only 2 of the 3 Special Editions were published in V1 (HS-01 missing) * Security has been **entirely rethought** for V2.1 * New security tools will be integrated (e.g., **Lynis** for hardening audits) * **The V1 guides are therefore outdated in practice** **Recommendation:** Wait for the publication of the V2.1 guides for an optimal experience. ### Author Profile & Transparency I am **not a certified IT professional**. This project is the result of a passion for system administration, built through **self-training over ~5 years**. * **Risk of error:** I rely on official documentation, but I am not immune to mistakes. * **AI assistance:** The documentation and architecture benefit from AI assistance, but **every command is human-verified**. * **Ethical stance:** Immediate abandonment of any tool whose privacy policy is questionable. > **📒 This project is a shared technical logbook.** > > *This is my personal infrastructure, built in my free time and for my own needs. I document it and share it because I hope it can help others in their journey toward digital sovereignty.* > > *The guides progress at my own pace — when I have time available. If the content helps you or inspires you, I am sincerely glad. If the publication pace or certain technical choices don't suit you, I completely understand: everyone has their own constraints, priorities and vision.* > > *The goal remains simple: to pass on what I learn, in my own way, without pretension.* ### Limitation of Liability Educational and personal project. The guides are provided **"as is"**, without express or implied warranty. * **No Guarantee of Accuracy:** The author does not guarantee the absence of errors or future incompatibilities. * **Security & Vulnerabilities:** No architecture is "vulnerability-free." The guides reflect the best of my knowledge as of their writing date. * **Deployment Responsibility:** It is imperative to test any procedure in an **isolated environment** before production. The administrator assumes full responsibility for the security of their data. --- ## 🗺️ Architecture: The 12 Deities > **⚠️ Important V2.1:** All deities are undergoing **revision/reintegration** into the new architecture. | Order | Deity | Role | Stack | V2.1 Status | |:---:|:---|:---|:---|:---:| | **01** | **VULCAN** 🔥 | Reverse Proxy & WAF | Traefik + CrowdSec + GateKeeper | 🚧 Under Redesign | | **02** | **AEGIS** 🛡️ | Sovereign DNS & VPN | WireGuard + AdGuard + Unbound + Amnezia | 🚧 Under Redesign | | **03** | **ARGUS** 👁️ | Monitoring | Grafana + Prometheus | 🔁 Under Review | | **04** | **JANUS** 🚪 | Identity & SSO | Bitwarden + Authentik | ✅ Audit Validated | | **05** | **ARK** 🗄️ | Multi-DC Backups | Restic (+ BorgBackup under consideration) | 🔁 Under Review | | **06** | **HERMES** 📧 | Sovereign Email | Postfix + Dovecot + SimpleLogin (reco) | ⚪ Blank | | **07** | **MIDAS** 💰 | Finance | — | ⚪ Blank | | **08** | **DIANA** 🗺️ | Mapping | Valhalla + OSM | 🔁 Under Review | | **09** | **VERITAS** 🔍 | Search | SearXNG | 🔁 Under Review | | **10** | **HEPHAESTUS** 🔨 | Git Forge | Forgejo | 🔁 Under Review | | **11** | **MNEMOSYNE** 🧠 | Cloud & AI | NextCloud + Ollama + Pangolin (under consideration) | 🔁 Under Review | | **12** | **PROMETHEUS** 🤖 | Local AI | Ollama + Mixtral | 🔁 Under Review | **Legend:** - ✅ **Validated** — Stack finalized and chosen, pending guide writing - 🚧 **Under Redesign** — Component validated, writing work in progress - 🔁 **Under Review** — Project compatibility to be verified, technical choices to be confirmed - ⚪ **Blank** — Not yet started --- ## 🤝 Trusted Third Parties & Dependencies > **Author's note:** 🤡 *I was so focused on the philosophy of forks, the V2.1 architecture and the research to improve the project... that I forgot the basics: mentioning the third parties with whom I share data. As usual, right. This is now corrected below.* ### 🇪🇺 Trusted Third Parties (Europe) | Third Party | Role | Shared Data | Location | Why? | |-------|------|-------------------|--------------|------------| | **👮 CrowdSec** | Collaborative security | Malicious IPs (anonymized) | 🇫🇷 France | Community-driven security, DPA signed | | **🇮🇹 Actalis** | SSL Certificates | Contact email | 🇮🇹 Italy | European authority, eIDAS compliant, free via ACME | | **🇵🇱 Certum** | S/MIME Certificates | Identity + Email | 🇵🇱 Poland | European authority for HERMES (future) | | **🇨🇭 Infomaniak** | Primary hosting | Data + billing | 🇨🇭 Switzerland | Sovereignty, ecology, DPA signed, €300 credit offered (3 months) | | **🇩🇪 Hetzner** | Multi-DC backups | Encrypted data | 🇩🇪🇫🇮 Germany/Finland | Geographic redundancy, cold storage | ### ⚠️ Technical Dependencies (Structural) | Tiers | Role | Shared data | Location | Why? | Long-term solution | |-------|------|-------------------|--------------|------------|------------------| | **🐳 Docker Hub** | Image registry | Email (free account) | 🇺🇸 USA | **Rate limiting** — Docker Hub is the reference registry. Almost all images are hosted there. Anonymous pulls are limited, hence the need for an account. | **Lesser evil:** HERMÈS + email alias to isolate (does not remove the dependency, but compartmentalizes it) | | **🔒 Bitwarden** | Password management | Email (license key) | 🇺🇸 USA | **Technical requirement** — Installation ID & Key required for self-hosting (even for Vaultwarden!). EU region available. | **Lesser evil:** HERMÈS + email alias to isolate (does not remove the dependency, but compartmentalizes it) | > **💡 In practice (real example):** > ``` > [email protected] > ├── [email protected] → Docker Hub > ├── [email protected] → GitHub > ├── [email protected] → GitLab > ├── [email protected] → Bitwarden (future) > ├── [email protected] → Public contact > └── ... (all the aliases you want) > ``` > **Advantage:** If a service leaks or spams, you know which one and you can revoke the alias without impacting the others. **Today:** Infomaniak Catchall. **Tomorrow:** HERMÈS + self-managed aliases. > **🎯 Goal:** These dependencies are **structural and inherent** to the project (Docker Hub = reference registry, Bitwarden = required license key). **Podman** can replace Docker Engine, but not Docker Hub. **HERMÈS** (sovereign email service) will make it possible to use aliases to **minimize the impact** (isolate each dependency) without being able to remove them entirely. ### 💡 Recommendation: SimpleLogin > **SimpleLogin** ([simplelogin.io](https://simplelogin.io)) is an email alias service that I **recommend** (without having personally tested it) for the following reasons: > - ✅ **Open Source** — Auditable code > - ✅ **French company** (owned by 🇨🇭 ProtonAG) > - ✅ **Free** — Generous free version > - ✅ **Affordable premium** — ~€36/year > - 🔗 **No affiliate link** — I receive no commission > > **Usage:** Alternative to the `+tag` aliases of Bitwarden/ProtonMail. E.g.: `[email protected]` instead of `[email protected]`. --- ## 🔗 Infomaniak Affiliate Links > **Philosophy:** Beyond the passive income to fund the project, these links are **practical shortcuts** that redirect directly to the services I use and recommend. **No extra cost for you.** | Service | Link | Usage | |---------|------|-------| | **🏠 Infomaniak — Home** | [infomaniak.com/goto/fr/home](https://www.infomaniak.com/goto/fr/home?utm_term=6acca8df963ee) | General home page | | **☁️ Public Cloud** | [infomaniak.com/fr/hebergement/public-cloud](https://www.infomaniak.com/fr/hebergement/public-cloud?utm_term=6acca8df963ee) | **€300 free over 3 months** — Ideal for testing | | **🖥️ VPS Cloud** | [infomaniak.com/fr/hebergement/vps-cloud](https://www.infomaniak.com/fr/hebergement/vps-cloud?utm_term=6acca8df963ee) | Standard VPS | | **💚 VPS Lite** | [infomaniak.com/fr/hebergement/vps-lite](https://www.infomaniak.com/fr/hebergement/vps-lite?utm_term=6acca8df963ee) | Entry-level VPS | | **💾 Synology NAS** | [infomaniak.com/goto/fr/hosting.synology](https://www.infomaniak.com/goto/fr/hosting.synology?utm_term=6acca8df963ee) | Hosted NAS | | **📦 myKsuite+** | [infomaniak.com/fr/ksuite/myksuite](https://www.infomaniak.com/fr/ksuite/myksuite?utm_term=6acca8df963ee) | Collaboration suite (Euria) | | **🤖 AI Tools** | [infomaniak.com/fr/hebergement/llm-api](https://www.infomaniak.com/fr/hebergement/llm-api?utm_term=6acca8df963ee) | AI API (Qwen, Kimi, etc.) | --- ## 📚 Documentation & Deployment Guides ### Documentation Structure (V2.1) The documentation is organized in the [`docs/`](https://gitlab.com/schroeder-sys/pantheon-souverainete/-/blob/main/docs) folder: * 🏗️ **Special Editions (3 variants):** Each foundation guide (Network, Firewall, Image) exists in **Cloud**, **VPS/Dedicated** and **HomeLab** versions. * 🔁 **To Be Rewritten:** HS-01: Building the Private Network (Cloud only) * 🔁 **Obsolete:** HS-02: The Perimeter Firewall (security rethought) * 🔁 **Obsolete:** HS-03: Creating the Debian Gold Image (new tools) * ⚔️ **Deities (coming soon):** Guides dedicated to each service (VULCAIN, AEGIS, ARGUS, etc.) > **📋 Note on environment variants:** > *Each Special Edition exists in **3 variants** depending on your infrastructure:* > * **☁️ Cloud** — **Recommended**. Full features, professional infrastructure, assumed budget (~€300/month). This is the reference. > * **🖥️ VPS/Dedicated** — **Compatible**. Budget alternative or "test that ends up in prod". Private network depends on the provider. > * **🏠 HomeLab** — **TOTAL sovereignty**. Data NEVER leaves your home/association. 0 internet access except updates (via AdGuard + Unbound). Dedicated network segment. > > **Publication order:** Cloud → VPS → HomeLab (from most complete to most specific) ### Deliverables Status | Component | Status | Notes | |-----------|--------|-------| | **🌐 Showcase Site** | ✅ Online | [pantheon-souverainete.eu](https://pantheon-souverainete.eu) | | **📄 README V2.1** | ✅ Finalized | Complete overhaul, radical honesty | | **🏗️ Architecture V2.1** | ✅ Defined | 12 deities, 3 environments, validated stack | | **🎨 Diagrams** | ⚪ To do | draw.io + Mermaid (Cloud / VPS / HomeLab) | | **📚 HS-01 (Network)** | 🚧 In progress | Cloud only | | **📚 HS-02 (Firewall)** | 🔁 Obsolete (V1) | To be rewritten with V2.1 security | | **📚 HS-03 (Gold Image)** | 🔁 Obsolete (V1) | 3 separate guides (Cloud / VPS / HomeLab) | --- ## 🛠️ Prerequisites & Contacts ### Required Skills | Level | Skill | Why? | Resources | |--------|------------|------------|------------| | **Beginner** | Bash command line | Navigation, file editing | [SadServers](https://sadservers.com/) | | **Intermediate** | Networking (IP, DNS, VLAN) | Understanding traffic flows | [OpenClassrooms](https://openclassrooms.com/) | | **Intermediate** | Docker/Podman | Containerization | [Docker Documentation](https://docs.docker.com/) | | **Advanced** | Security (firewall, SSH) | System hardening | [Debian Security Guide](https://www.debian.org/doc/manuals/securing-debian-manual/) | ### Work Environment (Author) | Tool | Use | Why? | |-------|-------|------------| | **🖥️ VSCodium** | Writing & Scripting | VS Code without Microsoft telemetry | | **🔑 Tabby.sh** | SSH manager | Open Source, cross-platform, plugins | | **🐧 Debian 13 (Trixie)** | Laptop OS + KDE | Latest stable, sovereignty, no telemetry | ### Recommended Test Environment * **Cloud:** [Infomaniak Public Cloud](https://www.infomaniak.com/fr/hebergement/public-cloud?utm_term=6acca8df963ee) — **€300 credit free for 3 months** (ideal for testing without touching your wallet) * **Target cost:** ~€50/month (test) vs ~€300/month (full production) ### Contacts | Topic | Channel | Response | |-------|-------|---------| | **🐛 Bug report** | Open an **Issue** on GitLab or GitHub (I do my best to respond) | Varies | | **❓ Project questions** | Email: [[email protected]](mailto:[email protected]) | When I can | | **💼 Professional contact / audit** | Email: [[email protected]](mailto:[email protected]) | Within 48h | --- ## 📅 Roadmap V2.1.0-alpha ### Version Cycle | Version | Completion Criteria | Status | |---------|---------------------|--------| | **Alpha** | All guides published + independently tested (lab) | 🚧 In progress | | **Beta** | Complete structure tested + guides updated with latest knowledge | ⏳ Upcoming | | **Stable** | Community feedback integrated + no critical bugs reported | ⏳ Upcoming | ### Deployment Phases | Phase | Period | Version | Duration | Hours | Status | |-------|--------|---------|----------|-------|--------| | **Phase 1** | Q4 2026 | `2.1.0-alpha` | 3 months | 80-100h | 🚧 In progress | | **Phase 2** | Q1 2027 | `2.1.0-alpha` | 3 months | 120-150h | ⏳ Upcoming | | **Phase 3** | Q2 2027 | `2.1.0-alpha` | 3 months | 100-120h | ⏳ Upcoming | | **Phase 4** | Q3 2027 | `2.1.0-alpha` | 3 months | 100-120h | ⏳ Upcoming | | **Phase 5** | Q4 2027 | `2.1.0-beta` | 3 months | 80-100h | ⏳ Upcoming | | **Phase 6** | Q1 2028 | `2.1.0` ✅ | 3 months | 60-80h | ⏳ Upcoming | | **Phase 7** | Q2 2028 | `2.1.0` | 3 months | 40-60h | ⏳ Upcoming | | **Phase 8** | Q3 2028+ | `2.x.0`+ | Variable | Variable | ⏳ Upcoming | **Version milestones:** - **End of Alpha** (Phase 4) → All guides published + independently tested - **End of Beta** (Phase 5) → Complete structure tested + guides updated - **Stable** (Phase 6) → Community feedback integrated + no critical bugs --- ## 📜 Licenses * **Source code (infrastructure):** [EUPL-1.2](https://gitlab.com/schroeder-sys/pantheon-souverainete/-/blob/main/LICENSE) — European Union Public Licence * **Textual content (guides, articles):** [CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/) — ShareAlike * **Showcase site:** EUPL-1.2 (code) + CC BY-SA 4.0 (content) --- > **Last updated:** October 20, 2026 > **Version:** 2.1.0-alpha > **Author:** Christopher Schroëder (Schroeder-Sys) > **AI assistance:** Euria, Qwen3.5, Kimi-K2.6
