Skip to content

Home

Jump to bottom
Fabrizio Salmi edited this page Jul 10, 2026 · 3 revisions

📖 The documentation has moved to flareover.com/docs

It's searchable, themed, and generated from the code — the coverage matrix and sovereignty tiers come straight from the engine, so they can't drift. This wiki is kept as a mirror and may lag; prefer the docs site.

flareover

Move your site off the orange cloud onto your own EU servers — without changing how it behaves.

flareover is an AGPL-3.0, single-binary Go engine that reads a live managed-edge zone and rebuilds the equivalent configuration for an open-source, self-hosted stack (Caddy, PowerDNS, CertMate, …) on EU-sovereign infrastructure.

Its one rule — the whole reason the project exists — is a 0% false-positive contract: it never emits configuration that silently changes behavior.

  • Where it can prove an exact equivalent, it applies it (AUTO).
  • Where a choice is genuinely ambiguous, it asks you one yes/no (ASK).
  • Where nothing maps faithfully, it flags the item for you and never guesses (MANUAL).

That is the difference between a migration you can trust and a migration you have to re-audit by hand.

Why this exists

Leaving a big managed edge means rebuilding, by hand, everything the dashboard quietly did for you — DNS, TLS certificates, redirects, firewall/WAF rules, caching — and hoping you didn't miss something that silently breaks the site. flareover does that rebuild deterministically and tells you, honestly, exactly what it could and could not carry over.

The 30-second tour

flareover extract example.com > zone.snapshot.json   # read-only, needs CLOUDFLARE_API_TOKEN
flareover assess  zone.snapshot.json                 # honest AUTO/ASK/MANUAL report
flareover resolve zone.snapshot.json --defaults > decisions.lock
flareover prepare zone.snapshot.json --decisions decisions.lock \
  --edge-ip 203.0.113.10 --out ./out                 # generate the target-stack config

Everything up to the DNS flip is a review artifact you can read in git before anything goes live. See Quick Start for a full walkthrough.

What's in the box

Concern Tool
Authoritative DNS Self-hosted PowerDNS, or a managed target via --dns — see DNS Targets
Reverse proxy / CDN / TLS Caddy (native ACME, HTTP/3)
WAF caddy-waf (OWASP, rate-limit, IP/ASN/country, blocklists)
Edge cache souin (Caddy module)
Certificates CertMate — DNS-01, wildcard, Let's Encrypt or Actalis (EU CA)
Object storage Self-hosted MinIO, or managed EU S3 — see Object Storage
Sovereign origin link WireGuard mesh (replaces the managed tunnel; origin stays inbound-free)
Egress shield (optional) secure-proxy-manager (default-deny + allowlist, fail-closed)

Where to go next

Status. All five phases are implemented; the five core adapters (PowerDNS, CertMate, MinIO, WireGuard mesh, secure-proxy-manager) are proven live against real services. The managed DNS/storage backends and the Terraform edge module are verified against each vendor's documented API and test harness (Tier B) and promoted to live-proven after a real run. Nothing claims a proof it hasn't earned — see Coverage Matrix.

flareover — deterministic migration off the orange cloud to EU-sovereign, self-hosted infrastructure · 📖 Docs · Repository · Releases · AGPL-3.0-only · © Fabrizio Salmi

flareover

📖 Full docs site →

Start here

Concepts

Reference

Help

GitHub · Site · AGPL-3.0

Clone this wiki locally