MacSouverain

FREN

My stack

My stack, the sovereign infrastructure I actually run

Update, July 2026. I rebuilt this page in three parts, the third-party tools I recommend, the foundation that carries everything, and what I self-host. One big change along the way, my mail has moved to self-hosting on Stalwart, filtered by my homemade gatekeeper the Stripper and read in my own tool Sigil, and the site you’re reading now runs on an Astro generator that I host too.

When a site recommends a tool to you, the first question that should come to mind is, “And you, do you actually use it?”

Fair question. Here’s my stack. Not a sponsor list dressed up as a personal page, not a cloud architect’s fantasy. It’s what runs at my place, every day, to handle my business and my digital life. Every brick was chosen, tested, broken at least once, and rebuilt.

I’ve sorted it all into three parts. First, the third-party tools I recommend and use myself. Then the foundation, the infrastructure I rent from third parties that carries everything else. And finally what I host on my own servers, where I no longer trust anyone but myself.

If I recommend something on MacSouverain, it’s because it’s part of this stack, or because I’ve tested it enough to talk about it honestly.

Contents

The third-party tools I recommend and use

The foundation, the third-party infra that carries everything else

What I self-host

The third-party tools I recommend and use

We’ll start with the simplest, the tools I didn’t write or host myself, but that I chose, tested, and recommend to you without reservation. You can install them this weekend without being a systems engineer. For most people, this first list is already enough to take back a good chunk of control.

Proton

Proton is a Swiss, end-to-end encrypted suite that bundles just about everything you’d ask of a Google Workspace: mail, calendar, drive, documents, video conferencing, VPN, password manager. Seven services, one subscription, one provider.

If you’re just starting your digital sovereignty journey and want to install only one brick, this is the one. You cut your dependence on Google or Microsoft in one move, without juggling ten accounts. One password, one bill, one interface. And everything is encrypted client-side by default, which means even Proton can’t read your data. It’s Swiss, so outside the EU, outside Five Eyes, outside the CLOUD Act, and their main datacenter is a former military bunker buried under the Alps. It’s hard to get more serious than that.

Me, I recommend the whole Proton suite for anyone starting out, but I don’t use all of it. The one piece I keep day to day is Proton Meet, their video conferencing. The rest, mail, drive, calendar, I’ve replaced with bricks I host myself, you’ll see that further down in the third part. It’s not a knock on Proton, it’s just that I push the cursor further than most people need.

Proton Meet, in short: end-to-end encrypted video, no history kept, that my guests can join without even having an account. It replaces Google Meet and Zoom without anyone, Proton included, being able to listen in on the meeting.

Transparency: I’m a Proton affiliate. Not because it earns me money, but because I share their philosophy and I keep recommending them to anyone starting out.

Passwords, Apple Passwords

For daily use, I use Apple’s built-in password manager. It’s native, synced across my devices, and it handles classic passwords as well as passkeys and two-factor codes. With Advanced Data Protection turned on (a checkbox in your iCloud settings), my vault is end-to-end encrypted: it lives on Apple’s servers, yes, but in an unreadable form whose key only I hold. Apple can’t read my passwords, and even faced with a US court order, it has nothing usable to hand over.

An honest note, because it matters: Advanced Data Protection doesn’t cover all of iCloud. Your iCloud mail, contacts, and calendar stay outside this end-to-end encryption, even with the protection on, for compatibility reasons with web standards. That’s precisely one of the reasons I pulled my mail, contacts, and calendar out of Apple to host them myself, as you’ll see below.

I go into detail in the password manager comparison.

The browser is the software that most of what you do online passes through. It’s what talks to the sites you visit, runs their code, decides what it keeps and what it blocks. At my place, two browsers coexist, with two clearly separated uses.

Safari for everyday. It’s the Mac’s native browser, the most integrated with the system, the easiest on the battery, and Apple has put decent anti-tracking protection in it by default. For the vast majority of my browsing, it does the job without my having to think about it. And above all, it benefits from the ad and tracker blocking I apply further down at the network level, in the Sovereign network section, protection that covers all my devices at once, browser or not.

Mullvad Browser for sensitive sessions. Every browser leaves sites a kind of technical fingerprint, a combination of details (screen size, installed fonts, settings) that, put together, makes you recognizable even without cookies. Mullvad Browser, developed with the Tor project, takes the problem backwards. Instead of trying to make you unique to hide you, it makes all its users identical: same configuration, same fingerprint presented to sites. The result, impossible to tell you apart from another Mullvad Browser user in the crowd. It’s a Tor Browser derivative, but without the Tor network, so it’s fast and usable day to day. I pull it out for sensitive research, identities I want to keep separate, sites that profile their visitors aggressively.

Two browsers, two uses, no mixing, a bit like having one pair of shoes for the city and one for the trail.

Little Snitch, the Mac's outbound firewall

Little Snitch is an outbound firewall for macOS: it intercepts every connection an application tries to open to the outside and asks whether you allow it. You quickly discover that your Mac, even at rest, quietly talks to dozens of servers without asking you a thing: telemetry, trackers, third-party services buried deep in an app you thought was harmless. With Little Snitch, you’re the one who decides what goes out, app by app, domain by domain. It’s the first concrete brick of sovereignty on a Mac, because it makes the invisible visible. I go into detail in the Little Snitch vs LuLu comparison.

Santa, the bouncer at the Mac's door

Santa is a tool built by Google, which uses it internally on its own Mac fleets. Its principle is radical: let only explicitly authorized software run on the machine. Everything else is turned away at the door. If an attacker manages to drop a malicious program on your Mac, they simply won’t be able to launch it, like a bouncer who turns away anyone not on the list. You keep this list of trusted publishers up to date, and the rest of the world stays outside. It’s brutal, and that’s exactly the point.

The foundation, the third-party infra that carries everything else

Before talking about what I host, I have to talk about where I host it and the network that ties it all together. These two bricks, I don’t build myself, I rent them from third parties I chose carefully. They’re the foundations. The whole third part sits on top of them.

Infomaniak, my servers and backups in Switzerland

My servers are VPSes, virtual private servers, hosted at Infomaniak, in Swiss datacenters. That’s where almost everything I self-host runs.

Why Switzerland: Swiss data protection law is one of the strictest in the world. Outside the EU, outside Five Eyes, outside the CLOUD Act. A US court can’t show up with an order and demand my data, it has to go through Swiss mutual legal assistance, which requires a Swiss judge, a real reason, and delays that discourage fishing expeditions.

Why Infomaniak: an independent Swiss company, not publicly traded, so no shareholder demanding that your data be monetized. Datacenters powered 100% by renewable energy. No data resale, no ads, no tracking, human support based in Switzerland. There, you’re a customer, not a product. And I never put everything on one big server: my services live on several machines, so that the failure or compromise of one leaves the others intact. You don’t put all your eggs in one basket.

Infomaniak also provides my backup target, Swiss Backup, a storage space hosted in Switzerland too. That’s where my backups land, but encrypted before sending by another tool I’ll talk about below, Kopia. In other words, Infomaniak keeps my backups without ever being able to read a single line.

Tailscale, the network that ties everything together

Tailscale is a private network that connects all my devices to each other, Macs and servers, through a permanent encrypted tunnel. Where a classic VPN routes all your traffic through a central server (which goes down, and everything goes down), Tailscale connects each device directly to the others, with no single point of passage.

Plainly: from anywhere in the world, my Mac reaches my servers and services as if they were in the same room as me, without my needing to open a single door onto the Internet. It’s also the command post for my whole fleet: it’s through Tailscale that I decide which devices see each other, and which DNS directory they point to. That last function, I use to hook my whole fleet onto my own resolver, but that’s a brick I host myself, more on it in the next part.

What I self-host

Here’s the heart of the matter. Everything that follows runs on my own servers, under my sole control. No provider to trust, no terms of service that change one morning, no account an algorithm suspends without warning. It’s more work, and it’s clearly not for everyone, but it’s the end of the sovereignty road.

Stalwart, my very own mail server

Stalwart is the server that now handles all my email. It’s what receives and sends my mail, in place of Proton Mail. It runs on one of my Swiss servers, with my own domain name, and I’m the only one with the keys to it.

Why move from a turnkey service to my own mail server? For total control. My messages are stored at my place, in a format I control, with the sorting rules, addresses, and automations I want, without depending on a provider’s choices.

It’s also the hardest brick in the whole stack, and I’ll say it plainly: hosting your own mail is a profession. You have to tend your sender reputation so your messages don’t land in other people’s spam, watch all of it closely, and accept that one wrong move can cut off your mail for several days. If you’re starting out, stay on Proton, it’s great and it’s more than enough. Self-hosted mail is a destination, not a starting point.

Stripper, the gatekeeper of your inbox

The Stripper is a homemade brick I wrote that runs on my own mail server. Its job: inspect every email, incoming and outgoing, and clean it before it touches anything at all.

On the way in, it strips the mail down. It rips out all the HTML dressing, those slick layouts that hide traps, and above all it kills the spy images, those invisible pixels that tell the sender the exact moment you open their message, from where, and on which device. What lands in my inbox is plain text, readable, with no snitch tucked inside.

Then it opens the attachments and looks under the hood. A booby-trapped Word document, an infected PDF, a file already flagged as malicious: if it smells something, it sets the attachment aside and delivers the message anyway, with a note at the bottom telling me what it removed and how to get it back if I really insist. No mail lost, ever, just the dangerous part put in quarantine.

And the other way, on what I send, it tidies up too. An outgoing email carries by default a heap of technical details about the machine and network that sent it, enough to give away my hardware and roughly where I am. The Stripper wipes these traces before the message leaves, so my correspondent receives my text, and nothing but my text.

Sigil, where I read my mail

Sigil is another homemade brick. It serves as my reading surface for mail: it’s where I go through the messages Stalwart receives and the Stripper has cleaned, now that Apple Mail is out of my life. And it’s also, more broadly, my internal development tooling, the workshop I use to tinker with and run my own tools.

I’m deliberately vague here, because it’s bespoke stuff that’s only of interest to me. Just hold on to the idea: what most people entrust to off-the-shelf apps, I run on a tool I wrote and control end to end.

SFTPGo, sharing a file with the outside world

Every now and then, I have to send a folder to someone who’s not on my private network, an accountant, a lawyer, a partner. For that, I set up SFTPGo, a little server I host that acts as my sharing counter to the outside. I drop the file, the person picks it up, without it passing through a Proton Drive, a Google Drive, or a WeTransfer.

Let’s be clear: it’s one-off sharing to third parties, not syncing my files between my devices. It’s a counter, not a cloud.

Etebase, my contacts, my calendar, my tasks

Etebase is the server that syncs my contacts, calendars, and task lists across all my devices, end-to-end encrypted, hosted on one of my servers. It speaks the standards that most calendar and address-book apps understand, so I keep using my usual apps, they just plug into my server instead of Google’s or Apple’s.

My appointments and my address book shouldn’t live in the same box as my mail, nor at a giant that reads them to sell me things. With Etebase, they live at my place, encrypted, and no one but me gets access.

Gitea, my forge for versioning everything

Gitea is my personal Git forge, hosted on one of my servers. Behind the word forge, there’s a simple idea: keep the full history of every text file I handle, my configurations, my scripts, my notes. Every change is dated, tracked, reversible. I can go back to any version from yesterday or six months ago.

GitHub belongs to Microsoft, GitLab is hosted in the United States. My own forge runs on a Swiss server, behind my private network, reachable only from my devices. No one else has access.

Matrix, my encrypted instant messaging

For instant messaging, I host my own Matrix server (with a lightweight implementation called conduwuit). Matrix is an open standard for end-to-end encrypted messaging, a bit like the email equivalent but for real-time chat: anyone can run their own server, and the servers talk to each other.

By hosting mine, my conversations don’t depend on any company that could read them, resell them, or shut the service down overnight. And end-to-end encryption means that even I, on my own server, only see unreadable content go by.

Kopia, my backups encrypted before they leave

Kopia is the engine that backs up everything, my Macs and my servers alike. Its main quality: it encrypts, compresses, and deduplicates my data on my own machine, before a single byte leaves. Only then does it push it to Swiss Backup, the Swiss storage space I mentioned in the foundation.

The nuance matters and I’ll say it honestly: Swiss Backup, on its own, does encrypt the data on its disks, but it’s Infomaniak that holds the keys to that encryption. It’s Kopia, on top, that turns my backups into unreadable noise with a key only I hold. As a result, what Infomaniak keeps for me, it can’t read: not the content, not the file names, not the folder structure. An order that got hold of the storage would recover nothing usable, because the key never left my machines.

The golden rule of backup is 3-2-1: three copies of your data, on two different media, one of them off-site. Kopia pushing to Switzerland is my off-site copy, end-to-end encrypted. And since Kopia writes in a standard storage format, I’m not a prisoner of anyone: if I want to change tools or providers tomorrow, my data follows me.

Sovereign network, my directory and my way out onto the Internet

When you type a site’s address into your browser, two things happen behind the scenes, and both leave traces. First, your device asks a directory, the DNS, which numeric address matches the site’s name. Then it connects to that address. By default, your ISP sees both, and therefore knows which sites you visit. I’ve closed both leaks, each with its own brick.

For the directory, I have my own DNS resolver, a piece of software called Unbound that I host myself. Instead of querying Google’s directory, Cloudflare’s, or my ISP’s (which would take the chance to note everything I look up), my resolver goes to fetch the information straight from the source, walking back up the official chain of servers that manage domain names. No commercial middleman sees the list of sites I visit go by.

For the way out onto the Internet, I use a Tailscale exit node, in other words one of my Swiss servers through which I route all my traffic out. Seen from outside, my connections seem to leave from that server, not from my place. My ISP, for its part, now sees only an encrypted tunnel: neither the site names, nor their destination addresses. It amounts to using a VPN, except the exit server belongs to me and no third party sniffs my traffic on the way.

The two bricks are complementary, and it’s together that they shut the door: the resolver makes the names invisible on the directory side, the exit node makes the destinations invisible on the traffic side. Taken separately, each one only plugs half the hole.

On top of that I added ad and tracker blocking, from a well-regarded community list (the Hagezi list), refreshed automatically every day. The point of doing it at the network level rather than in the browser is that it protects everything: the iPhones, where no browser extension is possible, and the Mac apps that quietly track without ever going through a browser. A single blocking rule, applied to my whole fleet at once.

Wazuh and CrowdSec, my control tower and my watchful neighborhood

Everything above only makes sense if my servers are watched and defended. Two bricks handle that.

Wazuh is my control tower. Every machine in my infrastructure continuously sends it the story of what’s happening on it. Wazuh cross-checks all of it and alerts me the moment something’s wrong: a connection that shouldn’t exist, a program trying to run when it has no business being there, a system file quietly modified. Without a brick like this one, you can get breached and never know it. With it, you have immediate proof that something happened, and you can react before it spills over.

CrowdSec is the watchful neighborhood. The idea is simple and beautiful: when an attacker tries to force a server’s door somewhere in the world, its address is reported to the whole network, and every member blocks it in advance. So my servers turn away at the door tens of thousands of addresses that misbehaved elsewhere, without my having had to run into them. And when someone tries their luck at my place, I feed the network in turn. Everyone flags the bad actors, everyone benefits.

Astro, the generator that runs this site

The MacSouverain site you’re reading right now runs on Astro, a site generator I host myself on a dedicated Swiss server. Concretely, Astro turns my texts into ultra-light, fast web pages: no big database running around the clock, no ecosystem of dubious plugins, no ad tracker embedded. Nothing but text served fast and clean.

This server is isolated from the rest of my infrastructure. No link to my private services, no shared password, no common database. If the site gets attacked, or if I break a config at three in the morning, the damage stays locked inside the site’s perimeter alone. Compartmentalize, that’s the first reflex.

Zero public exposure doctrine

One rule caps this whole third part: none of my internal services is reachable directly from the Internet. There are only two exceptions, and they’re forced: the mail server, which does have to receive mail from the whole world, and the site you’re reading, which does have to answer your visit. Everything else, my forge, my calendar, my messaging, my monitoring tools, lives behind my private Tailscale network, reachable only from my devices.

The Internet has no front door to these services, because there isn’t even a door. Nothing to guess, nothing to scan, nothing to force: for anyone not on my network, the service simply doesn’t exist. It’s the principle of “what isn’t exposed isn’t attacked”, and it’s what cleanly closes off the whole stack.

This stack isn’t set in stone. It evolves as tools mature, as threats change, or as I find something better elsewhere. This page gets updated when something moves. If you see a brick worth debating, or an angle I’ve missed, give me a shout.