Someone else’s yard

Before the move, Golem Trust sold sovereign hosting and ran it on one company’s machines. The compute for the Patrician’s Office, the Royal Bank and half the Circle Sea’s guilds sat on Hetzner in two of its regions, the object storage was Hetzner’s, and the nightly backups were Hetzner Storage Boxes in the same yard. The reassurance the founders gave customers, European, strict about data protection, far from Ankh-Morpork’s chaos, was true and stopped one company short of the bottom. The scraps for this layer say what the customer’s side had already found and the provider had not written down: a sovereign service standing on one operator is sovereign exactly as deep as that operator’s willingness to keep serving it.

What sits on what

The first scrap was an inventory, and it came back shorter than a firm this size expects. Ponder Stibbons, who had spent years keeping one large and temperamental machine alive at the University, knew the shape of a single point of failure on sight. Compute, on Hetzner, in two regions. Object storage, on Hetzner. The backups, on Hetzner Storage Boxes in Finland, five terabytes, keys in the vault. Disaster recovery, such as it was, ran to snapshots on the same Hetzner volumes, which is to say into the same account at the same company as the thing they were meant to bring back. One operator held the primary, the replica and the backup. Two regions is not two companies, and a Storage Box beside the server it backs up is the network share on the same machine again, at the scale of a bank.

The customer drew it first

Reading up from underneath is unusual, so it helped that someone had already read down from above. The Home’s move off its tenant ended on this yard: its files, its identity provider and, through the bank, its donor ledger all bottomed out on the same German datacentre company, on four contracts none of which mentioned the others. The Home’s coins drew the Royal Bank onto it too. What four separate providers looked like from above, a shared floor nobody had noticed, Golem Trust saw from below as one point: the same Hetzner, holding both the things it hosts and the things it hosts them on.

A second yard

The move was not to leave Hetzner. Hetzner is a German company on its own hardware, which is the property Golem Trust was selling in the first place, and taking the Royal Bank’s production off it is a programme measured in years, not scraps. The move was to stop being one company deep. Disaster recovery and the backups now go to a second operator that shares no owner, datacentre or network with Hetzner: OVHcloud, OVH Groupe SA of Roubaix, on its own hardware, with Scaleway of the iliad group written down as the alternative. The copy is encrypted before it leaves, so the second operator is somewhere to keep bytes and not a second company to trust with them. A Hetzner outage is now a failover, and a Hetzner decision is now a move with somewhere to move to, rather than the end of the sentence.

What did not move, and the hard part

Most of it did not move. The primary is still Hetzner. A genuinely independent second region, a different operator carrying live production on a different network under a different grid, is the expensive version, and for a firm hosting a national bank it is a multi-year programme with a regulator in the room. What was done instead is the groundwork that keeps the option open: the platform portable by design, vanilla Kubernetes rather than a managed one, storage that Ceph or MinIO can serve, an open backup format, and the Hetzner-specific glue kept behind an interface so a second operator is a configuration and not a rewrite. The concentration is reduced at the backup and disaster-recovery layer, and still standing everywhere else.

The yard

   before                                  after

   Patrician's Office, Royal Bank,         primary: Hetzner, two regions
   Establishment, the guilds                    │
        │                                   DR and backups: a second operator (OVHcloud),
   Golem Trust                                  encrypted before they leave
        │                                        │
   Hetzner: compute, object storage,       portable by design: vanilla Kubernetes,
   backups, DR snapshots                        open storage, open backup format,
   one operator, one account                    Hetzner behind an interface

The compute still on Hetzner, the backups and disaster recovery at a second operator that shares nothing with the first, the copies encrypted before they leave, the platform kept portable so a move is configuration rather than reconstruction, and the one-operator floor named as the largest thing the move did not lift.

What could go wrong?

  • Hetzner suspends Golem Trust, and everything it hosts stops at once, while the encrypted copy at the second operator is what the morning is rebuilt from.

  • A designation reaches Hetzner through its bank, insurer or lawyers, and everyone it hosts finds out whose yard they were standing on, which is the threat the alliance already names.

  • The second operator turns out to share an upstream network or a transit provider with Hetzner, and the two yards were less separate than the contracts said.

  • The portability groundwork is never exercised, and the day it is needed is the day everyone learns which Hetzner-specific assumption nobody abstracted.

Nanny Ogg owns her cottage, her garden, and the ground beneath both, and holds that the last of the three is the one nobody thinks to check they own until the day somebody else does.