Sovereignty: The Illusion of Security without Automation

When people talk about building their own cloud, they usually focus on the cool stuff: spinning up containers, creating sleek dashboards, and showing off a fancy setup. I have to confess I’m no different. There is a strange satisfaction in watching a new service launch on your own hardware without asking permission from Microsoft, Google, or who else in the world.

But here is the dirty little secret nobody talks about: If you don’t automate maintenance and security, you don’t have a private cloud. You just have a ticking time bomb running in your meter cupboard.

Sovereignty: A VPN Outside the Blast Radius

While running outdoor, my mind has all the time of the world to reflect. During one of my recent runs, I was thinking of my sovereignty journey that progressed nicely. In the previous months I tackled a lot of hurdles such as power failure resiliency, robust storage, remote backup, minimal overhead, centralized monitoring and alerting, infrastructure as code, private networking, internet connectivity.

Despite of these successes, a little voice kept nagging in my head. What if the container runtime goes down? What if critical services go down? What if mounts become inaccessible or the reverse proxy stops? I tried to counter argue with myself by throwing arguments as “how big is the chance?”, “If I’m behind my laptop I can fix it”. While both arguments are fair, I realized that if there are serious problems, likely the VPN Server container is down as well. I found a major flaw in my setup. I was occupied the rest of the run. I hate to waste a good run… sigh

Sovereignty: Who is monitoring my cloud?

Chaos, Chaos and Chaos. That’s how I want to describe Last week. How stupid could I be, neglecting maintenance on my servers. What possibly could go wrong!

I still get angry with myself over this rookie mistake. No matter what platform, there is always systems maintenance that needs to be done in the background. On the other hand, as being cloud native, this was something to be expected. On the hyperscalers, maintenance is done in the background, tucked away from the end user.

Sovereignty: Is there a SysAdmin in the room?

For months my private cloud ran like a charm, suddenly my Gitea runners stopped working. In the runner output I noticed the message that my disk was full. Pocket‑ID, my identity provider, had some occasional hick‑ups. This slow decay of my cloud started the day I launched the individual services, no magic fairies that kept my cloud in a pristine condition. I omitted the obvious, I omitted some old skool system administration. Something that you get for free if you use one of the big hyperscalers.

Sovereignty: Identity Confirmed!

As you may know, I’m working my way out of American BigTech. A journey that is more complex than it seems at a first glance. There are so many choices that you need to make, such as hosting, technology stacks, containerization, storage, backup and restore strategies, continuous delivery etcetera. All of this need to be in place before you even can think of deploying your workloads. At this moment I almost reached the phase in which I can start deploying my workloads.

Backups: The Illusion of Safety

Something was very, very wrong.

Every day, for weeks, the same two emails landed in my inbox: Backup failed. Data corrupted. At first, I ignored them. Big mistake.

A corrupted backup is, in many ways, worse than having no backup at all. You think you’re protected—until the moment you actually need it. That’s when false confidence turns into real risk.

Time to get this sorted out, once and for all.

Sovereignty: When the lights go out!

No matter how meticulously you set up your infrastructure, a power grid failure will take your servers down, unless you have a UPS (Uninterruptible Power Supply) to keep things running. A UPS takes over the power supply, until its battery runs out.
But here’s the catch: even the best UPS is pointless if your services don’t restart automatically when power returns.

I recently put this to the test while installing a car charger at home. For science and out of curiosity, I unplugged the main power line feeding the UPS. The UPS took over instantly, and the Lenovo server, network equipment, and the Synology NAS kept running smoothly.