schroeder-sys/pantheon-souveraineteInfrastructure cloud modulaire, redondante et 100% souveraine pour s'affranchir des GAFAM. Guides techniques, architecture Zero-Trust et chiffrement interne (DoT/DoH)
> 🏠 **Developed on:** [GitLab](https://gitlab.com/schroeder-sys/pantheon-souverainete) · 🪞 **Mirror:** [GitHub](https://github.com/schroeder-sys/pantheon-souverainete) · 🌐 **Site:** [pantheon-souverainete.eu](https://pantheon-souverainete.eu)
[](#)
[](#)
[](LICENSE)
[](#)
---
# 🏛️ The Pantheon of Sovereignty
> **What if your data *truly* belonged to you?**
>
> Not in the legal sense of a ToS that nobody reads. In the literal sense: it **never** leaves a server that **you** control. No algorithm scans it. No foreign government has access to it.
>
> **The Pantheon is exactly that:** a complete cloud architecture, designed so that **a single person** — you, me, anyone — can regain total control of their digital life. Not by cobbling together 15 outdated tutorials. Not by making dubious compromises. By following guides that are **thought out, tested, documented** so that it works.
>
> **12 services** (your own Gmail, Drive, Maps, etc.). **3 trust zones** (HOSTILE, DMZ, SAFE). **2 gates** (VULCAIN in, AEGIS out). **Zero GAFAM** in the stack.
>
> Welcome. 🚀
---
## ⚠️ Disclaimer (because honesty starts right away)
**I am not a *certified* IT professional.** No engineering degree, no Cisco/Microsoft certification, no traditional academic background. Just an IT self-employed entrepreneur (Schroeder-Sys) who has been self-taught for about 5 years, who built **his** infrastructure for **his** needs, and who documents the journey. **Yes, I offer professional IT services** — [schroeder-sys.fr](https://schroeder-sys.fr) — and **yes, this project is sponsored by my own business.** The two are compatible.
**This project is not a business.** It is personal work, done in **my** free time, with **my** constraints. The guides progress when I have time available. If the pace doesn't suit you, I understand: **everyone has their own priorities.**
**This project is not perfect.** There are structural US dependencies (Docker Hub, Bitwarden) — I list them, I isolate them, I don't hide them. There are deliberate technical choices (Debian > Ubuntu, AmneziaWG > WireGuard) — I explain them, I don't impose them.
**This project is free.** If the content helps or inspires you, I am sincerely glad. If some choices don't suit you, that is equally respectable. **Sovereignty is a personal choice — not a religion.**
---
## 🎯 The Project (for real, not marketing)
### What is it?
**A 100% sovereign cloud architecture** — 12 self-hosted services organized into **3 trust zones**:
| Zone | Content | Exposure |
|------|---------|------------|
| **🌐 HOSTILE** | Internet, Hetzner DC (DE/FI) | 0 control — everything outside our perimeter |
| **🟡 DMZ** | VULCAIN (entry) + AEGIS (exit + VPN) | Direct contact with the hostile — increased monitoring |
| **🟢 SAFE** | The 10 other deities | Unreachable from the Internet — filtered upstream by the DMZ |
**Golden rule:** The VPN (AEGIS) **NEVER** bypasses VULCAIN. Even in a tunnel, traffic goes back through the entry gate. **Zero-Trust, not as a slogan — as an architecture.**
### Who is it for?
| Profile | Why |
|--------|----------|
| **🏠 Committed individual** | You want to take back control without relying on outdated YouTube tutorials |
| **🏢 Small organization / NPO** | A sovereign, controlled, economically viable alternative to proprietary cloud suites |
| **🛠️ Self-hosted enthusiast** | You like understanding **why** before **how**, and you value thoughtful architecture |
| **🎓 Motivated learner** | You are ready to invest time (networking, Docker, security) with demanding guides |
**Honest prerequisites:** Bash (beginner), Networking (intermediate), Docker (intermediate), Security (advanced). If you are a complete beginner, this project is **educational** — but demanding.
> **📚 Se former avant de commencer :**
> - **Docker :** [docker.com/trainings](https://www.docker.com/trainings/)
> - **GitLab :** [university.gitlab.com](https://university.gitlab.com/)
> - **GitHub :** [learn.github.com](https://learn.github.com/)
> ### 🚀 Beginner? Start here
>
> 1. **Read the Disclaimer** (2 min) — to find out if this project is for you
> 2. **Explore the architecture** ("The 12 Deities" section) — understand the "why" before the "how"
> 3. **Follow HS-01 (Private Network)** — the foundation (VULCAIN + AEGIS), testable in a weekend *(coming in November)*
> 4. **Come back for the rest** — no need to install everything at once
>
> 💡 **Tip:** Contextual glossaries are available at the end of each technical section. Click on "📖 Glossary" to display the definitions.
### Where is the data? (Reference architecture)
- **Primary:** Infomaniak (**Switzerland** 🇨🇭) — Public Cloud *(the project's choice, not an obligation)*
- **Backups:** Hetzner (**Germany** 🇩🇪 + **Finland** 🇫🇮) — Encrypted Object Storage
- **Stack:** 100% open source
- **US dependencies:** Docker Hub, Bitwarden — minimized and compartmentalized via email aliases
> **Note:** This architecture is **reproducible** elsewhere. You can host it at home (HomeLab), on an OVH VPS, or with another European provider. The principles (zones, flows, sovereignty) remain valid — only the providers change.
---
## 🤝 Sponsors & Affiliation (full transparency)
**Funding:**
- **Schroeder-Sys** (my IT sole proprietorship) — sponsors the project (hosting, development time, testing)
- **Infomaniak affiliation** — links **disclosed** (see table below)
- **No hidden advertising**, no fundraising
- **Open to other sponsors** — do you have a product/service aligned with European sovereignty? [Let's talk](mailto:[email protected])
> **Transparency:** The links below are **affiliate links** — same price for you, I receive a commission. The **€300 in free credit** is provided by Infomaniak (to be used within 3 months), whether or not you click on my link.
### Infomaniak affiliate links
| Service | Link | Usage |
|---------|------|-------|
| **🏠 Home** | [infomaniak.com/fr/](https://www.infomaniak.com/goto/fr/home?utm_term=6acca8df963ee) | General home page |
| **☁️ Public Cloud** | [infomaniak.com/fr/hebergement/public-cloud](https://www.infomaniak.com/fr/hebergement/public-cloud?utm_term=6acca8df963ee) | **€300 free for 3 months** — ideal for testing |
| **🖥️ VPS Cloud** | [infomaniak.com/fr/hebergement/vps-cloud](https://www.infomaniak.com/fr/hebergement/vps-cloud?utm_term=6acca8df963ee) | Standard VPS |
| **💚 VPS Lite** | [infomaniak.com/fr/hebergement/vps-lite](https://www.infomaniak.com/fr/hebergement/vps-lite?utm_term=6acca8df963ee) | Entry-level VPS |
| **💾 NAS Synology** | [infomaniak.com/goto/fr/hosting.synology](https://www.infomaniak.com/goto/fr/hosting.synology?utm_term=6acca8df963ee) | Hosted NAS |
| **📦 myKsuite+** | [infomaniak.com/fr/ksuite/myksuite](https://www.infomaniak.com/fr/ksuite/myksuite?utm_term=6acca8df963ee) | Collaboration suite (Euria) |
| **🤖 AI Tools** | [infomaniak.com/fr/hebergement/llm-api](https://www.infomaniak.com/fr/hebergement/llm-api?utm_term=6acca8df963ee) | AI API (Qwen, Kimi, etc.) |
**Recommendation (no affiliation):**
- **SimpleLogin** ([simplelogin.io](https://simplelogin.io)) — 🇫🇷 French (ProtonAG 🇨🇭), free, open source. Never personally tested.
---
## 🏛️ The 12 Deities
### Fork Philosophy
**Rule:** A fork is only justified if it brings a **significant gain in security or privacy**. Otherwise, we stick with the source.
| Choice | Why |
|-------|----------|
| **Debian > Ubuntu** | Debian is the source. You can't wait for a patch on the system itself (security & stability). |
| **AmneziaWG > WireGuard** | Deliberate fork: significant gain in privacy (anti-DPI obfuscation). They work with WireGuard. |
| **Bitwarden > Vaultwarden** | Bitwarden is the source. Vaultwarden itself indicates incompatibility windows. |
> <details>
> <summary>📖 <b>Glossary for this section</b> (click to expand)</summary>
>
> - **Fork**: A copy of an open source project modified independently. Here, we only fork if it improves security/privacy.
> - **Anti-DPI obfuscation**: Technique to mask VPN traffic so it isn't detected/blocked by ISPs or governments (DPI = Deep Packet Inspection).
>
> </details>
### Technical Choices
**Decision triptych:** Security · Compatibility · Simplicity
- **wg-easy** (vs raw WireGuard) — Ease of use, web configuration.
- **GateKeeper** (vs Altcha) — Compatible with CrowdSec, documented, natively integrated.
> <details>
> <summary>📖 <b>Glossary for this section</b> (click to expand)</summary>
>
> - **wg-easy**: Simple web interface for managing WireGuard. More accessible than the command line.
>
> </details>
### Trust Tiers & Dependencies
| Tier | Role | Data | Location | Status |
|-------|------|---------|--------------|--------|
| **CrowdSec** | Collaborative security | Malicious IPs (anonymized) | 🇫🇷 France | ✅ Trusted |
| **Actalis** | SSL certificates | Contact email | 🇮🇹 Italy | ✅ Trusted |
| **Certum** | S/MIME certificates | Identity + Email | 🇵🇱 Poland | ✅ Trusted |
| **Infomaniak** | Primary hosting | Data + billing | 🇨🇭 Switzerland | ✅ Trusted |
| **Hetzner** | Multi-DC backups | Encrypted data | 🇩🇪🇫🇮 Germany/Finland | ✅ Trusted |
| **Docker Hub** | Image registry | Email (free account) | 🇺🇸 USA | ⚠️ Structural dependency |
| **Bitwarden** | Passwords | Email (self-host license key) | 🇺🇸 USA | ⚠️ Structural dependency |
> **Philosophy:** US dependencies (Docker Hub, Bitwarden) are **structural and inherent**. Mail aliases don't eliminate them, they **isolate** them.
> <details>
> <summary>📖 <b>Glossary for this section</b> (click to expand)</summary>
>
> - **Anonymized data**: Information from which personal identifiers have been removed. CrowdSec receives attacker IPs, not your identity.
> - **S/MIME**: Standard for encrypting and signing emails. Certum provides the certificates to prove your identity.
> - **Registry**: A library of Docker images. Docker Hub is the "Google Play" of containers.
> - **Structural dependency**: A dependency that cannot be removed without rewriting everything. You isolate it, you don't deny it.
>
> </details>
> **How to read the diagram:** 🌐 **HOSTILE** = 0 control (Internet, Hetzner DC) · 🟡 **DMZ** = the only 2 bridges to the outside, under heightened surveillance — **VULCAIN** (100% of inbound traffic) + **AEGIS** (100% of outbound requests + VPN) · 🟢 **SAFE** (core) = the 10 business deities, access filtered upstream. **The VPN NEVER exempts traffic from passing through VULCAIN.**
>
> 🔍 **Zooms:** [Global topology (SVG)](https://gitlab.com/schroeder-sys/pantheon-souverainete/-/blob/main/docs/99_COMMUN/schemas/topologie-globale.svg) · [Typical traffic scenarios (SVG)](https://gitlab.com/schroeder-sys/pantheon-souverainete/-/blob/main/docs/99_COMMUN/schemas/exemples-circulation.svg)
### Foundation (4 deities — essential)
| Deity | Role | Stack | V2.2 Status |
|----------|------|-------|-------------|
| **VULCAIN** | Entry point — reverse proxy & WAF | Traefik + CrowdSec + GateKeeper + **Pangolin (mTLS via WireGuard) under consideration** | 🚧 In progress |
| **AEGIS** | Exit point — sovereign DNS & VPN | WireGuard + AdGuard + Unbound + **AmneziaWG (anti-DPI obfuscation)** | 🚧 In progress |
| **ARGUS** | Active monitoring | Grafana + Prometheus + Node Exporter | ⚪ Blank |
| **ARK** | Multi-site vault | Restic + **BorgBackup (under consideration)** | 🔁 Under review |
> <details>
> <summary>📖 <b>Glossary for this section</b> (click to expand)</summary>
>
> - **Reverse Proxy**: A server that receives all incoming requests and routes them to the right services. One door, not 12.
> - **WAF**: Web Application Firewall — filters web attacks (injections, XSS, etc.) before they reach your services.
> - **mTLS**: Mutual TLS — certificate-based authentication in both directions (client AND server). More secure than a password.
> - **Sovereign DNS**: You manage your own name resolutions, without going through Google/Cloudflare. Your DNS requests don't leave.
> - **Active monitoring**: Real-time collection of metrics (CPU, RAM, network) to detect anomalies before failure.
>
> </details>
### Business (8 deities — final services)
| Deity | Role | Stack | V2.2 Status |
|----------|------|-------|-------------|
| **JANUS** | Identity & SSO | Bitwarden + Authentik | 🔁 Under review (Authentik audited) |
| **MNÉMOSYNE** | Data & collaboration | NextCloud + **Online office suite (to be defined)** | 🔁 Under review |
| **HERMÈS** | Sovereign email | Postfix + Dovecot + **SimpleLogin (recommendation)** | ⚪ Blank |
| **HÉPHAÏSTOS** | Internal forge | Forgejo (self-hosted Git) | ⚪ Blank |
| **VERITAS** | Information search | SearXNG | ⚪ Blank |
| **DIANE** | Maps & plans | **Valhalla + OSM** | ⚪ Blank |
| **MIDAS** | Finance & accounting | — | ⚪ Blank |
| **PROMÉTHÉE** | Local AI | **Ollama + Mixtral** | ⚪ Blank |
> <details>
> <summary>📖 <b>Glossary for this section</b> (click to expand)</summary>
>
> - **SSO**: Single Sign-On — a single password to access all your services (via Authentik).
> - **Online office suite**: Equivalent of Google Docs/Sheets, but self-hosted (Collabora, OnlyOffice, etc.).
> - **Self-hosted Git**: Self-hosted version of GitHub/GitLab. You keep full control of your code.
> - **OSM**: OpenStreetMap — free and open maps, the open-source equivalent of Google Maps.
>
> </details>
> **🤡 Author's note:** I was so focused on the philosophy of forks, the V2.2 architecture and the research to improve the project... that I forgot the basics: mentioning trusted third parties. As usual, right.
---
## 📅 Roadmap
### In short (for those in a hurry)
| Step | Content | Time |
|-------|---------|-------|
| **🚀 Foundation** | VULCAIN + AEGIS — the 2 gates | ~20h |
| **🔒 Reinforcement** | + ARGUS (monitoring) + ARK (backups) | ~40h |
| **🏛️ The other 8** | At your own pace, according to your needs | ~600h |
### Version cycle (SemVer)
> **⚠️ Important:** The hour estimates above concern **the creation of the guides** (my dev/test/writing time), **NOT your deployment time**. Once the guides are published, deploying the 12 deities takes **less than a week** (tests included) by following the steps.
| Phase | Period | Version | Duration | Hours (creation) | Status |
|-------|---------|---------|-------|-------------------|--------|
| **Phase 1** | Q4 2026 | `2.2.0-alpha` | 3 months | 80-100h | 🚧 In progress |
| **Phase 2** | Q1 2027 | `2.2.0-alpha` | 3 months | 120-150h | ⏳ Upcoming |
| **Phase 3** | Q2 2027 | `2.2.0-alpha` | 3 months | 100-120h | ⏳ Upcoming |
| **Phase 4** | Q3 2027 | `2.2.0-alpha` | 3 months | 100-120h | ⏳ Upcoming |
| **Phase 5** | Q4 2027 | `2.2.0-beta` | 3 months | 80-100h | ⏳ Upcoming |
| **Phase 6** | Q1 2028 | `2.2.0` ✅ | 3 months | 60-80h | ⏳ Upcoming |
| **Phase 7** | Q2 2028 | `2.2.0` | 3 months | 40-60h | ⏳ Upcoming |
| **Phase 8** | Q3 2028+ | `2.x.0`+ | Variable | Variable | ⏳ Upcoming |
**Milestones:**
- **End of Alpha** (Phase 4) → All guides published + independently tested
- **End of Beta** (Phase 5) → Complete structure tested + guides updated
- **Stable** (Phase 6) → Community feedback integrated + no critical bugs
> **⚠️ Important:** I **never** promise specific dates. A "96h" estimate has already slipped by 2 months for personal reasons. The phases are goals, not commitments.
---
## 🎯 Conclusion (because we have to wrap up)
**Digital sovereignty is not a luxury, it's a choice.** And that choice should be accessible — not reserved for a technical elite or enterprise budgets.
**The Pantheon is my answer** to this observation. An architecture that is **real**, documented **honestly**, shared **for free**. No promised dates. No magical "it works on the first try." No hidden dependencies.
**This project is mine.** It's **my** infrastructure, built on **my** free time, for **my** needs. I document it and share it because I hope it will help other people in their own journey.
If the content helps you or inspires you, I'm sincerely glad. If the pace or certain choices don't suit you, I completely understand: **everyone has their own constraints, priorities, and vision.**
---
## 🤝 Contributing (because this project is also yours)
**This README is alive.** If you find an error, a typo, an inconsistency — open an **Issue** on GitLab or GitHub. I do my best to respond.
**If you want to go further:**
- **Submit a PR** — An improvement, a complementary guide, a zoomed-in diagram? I'm all for it.
- **Share your experience** — Have you deployed the Pantheon? Did you get stuck on something? Your feedback helps the community.
- **Contact me** — [[email protected]](mailto:[email protected]) — I reply when I can, but I do reply. Promise.
> **🆕 New to GitLab/GitHub?**
> - **GitLab:** [university.gitlab.com](https://university.gitlab.com/) — Issues, Merge Requests, etc.
> - **GitHub:** [learn.github.com](https://learn.github.com/) — Issues, Pull Requests, etc.
**Need professional support?**
- **Pro site:** [schroeder-sys.fr](https://schroeder-sys.fr) — Audit, integration, support (if you want to go further with a human)
- **Pro email:** [[email protected]](mailto:[email protected]) — Quotes, audit, integration
---
> **🚀 You've reached the end.**
>
> If this README has made you want to go further, it's because you've grasped the essentials. **Sovereignty is a choice — and that choice is yours to make today.**
>
> **Where to start?**
> 1. **Disclaimer** — Know what you're getting into (2 min)
> 2. **Architecture** (section "The 12 Deities") — Understand the "why" before the "how"
> 3. **Guides** (Special Editions) — HS-01 (Private Network) arrives in November
> 4. **Contribute** — A mistake? An improvement? This project is as much yours as it is mine
>
> **Thank you for reading.** And above all: **happy building.** 🏛️
>
> — Christopher Schroëder
>
> **Last updated:** October 28, 2026
> **Version:** 2.2.0-alpha
> **Author:** Christopher Schroëder (Schroeder-Sys / Greencode Solutions)
> **AI assistance:** Euria (myKsuite+), Qwen3.5 & Qwen3.8, Kimi-K2.6 (AI Tools Infomaniak)