La Contre-Voie - News

ft_chatons: a last tribute to 42

neil — Thu, 26 Feb 2026 18:00:00 +0200

Almost eight years ago, La Contre-Voie was founded under the name “42l”, a student association at the higher education institution 42Paris</a> — a private, free computer science school funded by French billionaire Xavier Niel.

The L in “42l” stands for ‘Libre’ (free), in the sense of digital freedoms, written in lowercase “because we are not pretentious” and pronounced with an imaginary French liaison “quarante-deux z’ailes” (as-in, forty-two wings) to evoke the wings of freedom. These communication choices, worthy of the young free software association that we were, led us to rename the association “La Contre-Voie” in July 2022, marking our departure from 42 after most of our members had completed their studies.

This network of digital campuses, where we produced more than 70 conferences in three years, is the starting point for our popular education initiative and an integral part of our identity.

As a farewell gift to 42, La Contre-Voie has created a free and open-source educational project called “ft_chatons”, which guides students through the creation of an ethical hosting provider as an alternative to the digital giants.

🔗</a>Creating a CHATONS</h3>
The name of the project refers to CHATONS</a>, a French-speaking collective that brings together nearly a hundred organizations aiming to democratize and widespread alternative services to Google, Microsoft, and the like.
This subject of 42 pages</a> involves reproducing a software infrastructure (i.e., a configuration on a computer server) which can host online services, similar to the 42l association when it was first created.
The project requires the installation of several fundamental components:
an SSO</a>, which allows a single account to be used for all the services, providing the user-friendliness and convenience of a Google account;</li>
the Nextcloud software suite</a>, a comprehensive alternative to the Google suite;</li>
a software forge service such as Gitea</a> or Forgejo</a> (your choice), to host code outside of centralized platforms such as GitHub (which is owned by Microsoft);</li>
…and other software, which you can discover in the subject PDF</a>.</li> </ul>
The intention is, of course, to raise students’ awareness of these software alternatives, while guiding them in setting up this free software on a server. The subject is designed to encourage them to use their infrastructure after the end of the project, so that it can serve as a personal cloud that can be shared with friends and family. Students can even apply to become members of the CHATONS collective, as meeting the criteria for the project guarantees compliance with the vast majority of the criteria set out in the collective’s charter</a>.

🔗</a>A project valued in the student curriculum</h3>
The subject was developed in partnership with the 42Angoulême campus, which offers 30,000 XP for the project — an amount of experience that represents a major step forward in the student curriculum, motivating students interested in system administration to complete this project.
Released in beta testing following a conference at 42Angoulême on February 19, 2026, the subject may eventually be tested at other volunteer 42 campuses, or even rolled out across the entire 42 network, subject to acceptance by their administration teams.
Finally, unlike almost all of 42’s educational projects, ft_chatons advocates a strict policy on the use of generative AI: its use is formally prohibited during the design of the project and penalized with a grade of -42.
🔗</a>…but also a digital commons</h3>
Developed in an open and transparent manner, the ft_chatons topic and its sources are available online</a> and contributions are welcome, especially for translating the topic into other languages or reporting bugs or inconsistencies.
Reusing the sources from a Python bootcamp</a> created by the student association 42AI, the project is published under a Creative Commons BY-NC-SA license, allowing free reuse of the subject provided that our work is credited, not used for commercial purposes, and modified versions are published under the same license.
We hope that this subject will make a modest contribution to the digital empowerment of students!
***If you support our approach and have the means to do so, you can* *make a donation</a> to contribute to our financial sustainability. Thank you!***

La Contre-Voie has a tough time: help us stay on course!

neil — Mon, 08 Dec 2025 18:00:00 +0200

The year 2025 marks a historic turning point for La Contre-Voie: we have recruited our first employee, launched five new services</a> and our instant messaging service</a>… Today, we are feeling the backlash: the transition from a volunteer-based organization to an employer is very costly, and we are struggling to meet the financial demands.
Like many other organizations, we are facing a decline in donations: times are tough for everyone, and this is affecting the financial capacity of our donors.
🔗</a>First approach: diversifying our funding</h3>
We first tried to diversify our sources of funding by launching our à la carte service offering</a>, with the firm intention of supporting associations</a> and other organizations in their de-Googling efforts at a fair and solidarity-based price.
For us, practicing fair pricing means ensuring that the financial resources of the organizations that contact us are never a barrier to the use of our free software tools, even if it means significantly reducing the rates we offer to small organizations.
🔗</a>The results in a few figures…</h4>
From September 2024 to November 2025, we digitally equipped 15 organizations: 7 associations, 2 cooperatives, 4 individuals, and 2 companies. The most requested service is Nextcloud (9 organizations), followed by WordPress (7 organizations). We are far from the figures achieved by other “giants” such as Zaclys</a> or Framasoft</a>, but for a first launch, we are quite satisfied :)
If we add up the current rates for each service, this represents a total of €3,600 in digital services! But since we practice solidarity rates, only €2,200 of this €3,600 is collected by the association. We can afford to offer these solidarity rates because we rely on our other sources of income to make up for this “free” portion.
Ultimately, hosting services would allow us to achieve significant economies of scale, but we don’t yet have enough beneficiaries for the difference to be significant: our entire infrastructure (and that alone) costs us around €100 per month, and this amount continues to increase as we upgrade our servers.
In short: between solidarity rates (which we consider necessary, but which cost us money) and the lack of beneficiaries in the first year of launch, this source of revenue is not yet sufficient to contribute significantly to personnel expenses.
We anticipated this slow start, which is why we applied for grants this year, as we believe it makes sense for the cultivation of digital commons to be partially funded by public funds.
🔗</a>Grants: four applications, €49,400 requested, €8,200 obtained</h3>
These items are already included in our moral report</a>, but we would also like to highlight them here.
In 2025, we undertook to prepare four grant applications to finance our digital support program, in particular to support associations; two of them were granted to us.
The Recrutement associatif</a> public grant offered by the Nouvelle-Aquitaine Region was the most attractive: available to sustain a new salaried position in an association, it provides €10,000 in funding for the first year, €7,000 in the second year, and €4,000 in the third year, for a total of €21,000 over three years.
Unfortunately, we were not awarded the grant, mainly because it is highly sought after and few applications are accepted (1 in 5), and because our projected budget did not offer sufficient guarantees that our organization would be able to sustain employment beyond the three years covered by the grant.
We also submitted an application for the private grant Digital technology for a more equitable society, offered by the Afnic Foundation</a>, for an amount of €12,000 over two years, which was also refused without reason.
The state grant FDVA 2 − Operating Costs</a> was granted to us for our activities in 2025, for an amount of €1,000 out of the €2,000 requested.
Finally, we reapplied to the Nouvelle-Aquitaine Region for the Mutations associatives</a> grant, which had been refused in 2024, for an amount of €14,400 over 18 months. We were asked to revise our provisional budget, as the amount requested was too high in relation to the resources that the Region wishes to commit; we therefore requested €7,200 for 18 months, and the Region has just accepted our request.
We would also like to thank the Region for choosing to support us financially, with a sum that represents a significant portion of our budget.
🔗</a>A fragile balance sheet</h3>
However, this balance sheet remains a mixed victory for us; a full-time salaried position at the minimum wage costs at least €25,000 per year, and we are still far from reaching this amount, both in terms of subsidies and donations or hosting services.
La Contre-Voie is also preparing for the non-renewal of the only employment contract signed within the organization in 2026, due to a lack of financial resources — although this does not compromise the idea of hiring again in the future, if the association’s financial situation allows it.
🔗</a>Is La Contre-Voie in danger?</h3>
Rest assured: we are not about to close or abandon our services, no matter what happens. Even if La Contre-Voie were to become a volunteer-only association again one day, we would continue to maintain the digital services currently offered and provide support by email.
Furthermore, even if the association is likely to be in deficit for its fiscal year (2025-2026) for the first time in its existence, we have enough cash reserves to weather the storm and reduce expenses for the following years.
Of course, we are never immune to a serious incident that could ultimately compromise the survival of the association, because nothing lasts forever; but if that should ever happen, we will do our best to notify you several months in advance and facilitate the migration to other ethical digital structures</a> if necessary.
🔗</a>A star to lift your spirits</h3>
If you find that our actions are meaningful, and you want to — and are able to — give us the means to go further, then we invite you to donate to La Contre-Voie.
For the 2024-2025 fiscal year, donations represent 50% of our total funding and remain essential to guaranteeing our independence and survival, even when subsidies are not forthcoming.
Next year, we hope to complete the objectives of our roadmap by consolidating the services we launched this year, and we may open new services depending on the needs identified.
We are counting on your support!
</div>
</div>

Drop your star</h3>
and donate to La Contre-Voie !</h4> </div> </a>

New service: instant messaging with video conferencing

neil — Wed, 08 Oct 2025 10:45:00 +0200

La Contre-Voie is launching a new instant messaging service, which also includes a videoconferencing platform!
Based on the Element software developed by the Matrix Foundation, this service is an alternative to Microsoft Teams or Slack.
</a>

It looks a bit like Discord, doesn’t it? </figcaption> </figure>
This service is available to all members of the association, as well as members of member organizations.
Click here to see the service overview page.</a>
🔗</a>One-click video conferencing</h3>
Video conferencing was one of the features we wanted to include with this messaging service: we want this service to be useful primarily for organizations (associations, collectives, and companies), which hold meetings fairly frequently.
</a>

Videoconferencing is integrated into the messaging service! Image source</a> </figcaption> </figure>
To start a video conference from a text chat channel, all it takes is one click of a button. The text channel can be used to take notes… or to allow those without a microphone to express themselves :)
🔗</a>We don’t skimp on features</h3>
We chose Element because it is (very subjectively) one of the most advanced free instant messaging clients available, with support for many features worthy of modern messaging software:

Threads: as in Slack (or Discord, but it’s not as well done), it is possible to start a discussion following a message, separate from the main channel. This allows you to create “sub-discussions” on several topics without having to create a separate channel, and avoids losing track when several discussions overlap.</li>
Emoji reactions and stickers: yes, for some people, being able to take a quick vote with emoji reactions is important! And yet, few messaging software programs support this. We’ve also added support for stickers because they’re fun and don’t require much work on our part.</li>
Voice messages, polls, attachments: if emoji reactions aren’t your thing when it comes to voting, use Element’s built-in voting feature! It’s the ideal option for formal votes during electronic deliberations, for example. Element also supports sending voice messages and attachments, just like any traditional messaging app.</li>
Multi-platform: Element can be installed</a> on Windows, Mac, Linux, Android, and iOS. And since the software and protocol are open-source, it’s even possible to use alternative clients to chat.</li>
Conversation encryption: Element end-to-end encrypts (E2EE)</a> all your private conversations by default, and you can enable encryption on any channel in which you have admin rights.</li>
Federation: Just like XMPP</a>, Element uses a federated messaging protocol to contribute to the decentralization of the Internet: accounts registered on other Element/Matrix installations (such as matrix.org</code>) can join our channels, and vice versa!</li>
100% free and open-source: as always, the entire software stack used to run this service is fully auditable and open-source.</li> </ul>🔗</a>Under the hood…</h3> This service is undoubtedly the most complex of our entire technical stack to date, as it depends on many small components. It is also connected to our internal and external monitoring service so that we receive notifications directly in the event of a failure of one of our services. It is equipped with an anti-spam system and a moderation tool (Draupnir</a>), a bot that synchronizes messages with our Discord channels (mautrix/discord</a>), and a notification server (ntfy</a>) to relay notifications to Android smartphones that have been de-Googled using the UnifiedPush</a> protocol. End of technical digression. 🔗</a>How do I use it?</h3> You can find a user guide directly on the service page</a>, in the FAQ section. This service is only available to members of La Contre-Voie, as well as members of organizations affiliated with La Contre-Voie. Unfortunately, we have had to restrict access to this service to our members in order to protect ourselves from spam and misuse of this messaging service, as other alternative hosts with similar services have experienced. Membership costs 10 euros per year</a> for individuals and gives you access to all member services, including email address creation</a>, cloud storage</a>, and a Git forge</a>. Membership does not commit you to anything, but it gives you a voice at our General Meetings if you ever wish to participate, and it allows us to continue to exist! If you find this service useful, feel free to try it out for yourself or your organization and let us know what you think!
La Contre-Voie launches five new digital services neil — Thu, 05 Jun 2025 10:45:00 +0200 As promised</a>, here are five new services designed primarily for associations, made possible thanks to your financial support and encouragement. This article introduces these new services and their main features. La Contre-Voie is putting its technical skills to good use: we’re launching a new set of tools designed for teamwork, based on the needs we’ve identified among a small number of structures. Although these services have been designed to meet the needs of associations / nonprofits, they can also be subscribed to by companies, local authorities and private individuals if they meet their expectations. Find below a detailed list of these new tools, followed by a short making-of on the creation of this offer! 🔗</a>Websites</h3> </div> We now offer website hosting</a> using WordPress</a>, an open-source software that helps you design websites without writing a single line of code! The first level, at 5 GB of space, should be more than enough to host a medium-sized website. Under the hood: the free software Garage</a>, based on the S3 protocol, which duplicates in real time all the websites we host on at least three different servers! </div> </div> </div> Finally, for those who don’t like WordPress and prefer the command line or other approaches, we offer static website hosting</a> under the same conditions as WordPress website hosting. 🔗</a>Dedicated Nextcloud</h3> </div> Finally, we offer a dedicated Nextcloud installation</a> for organizations. Nextcloud is a software suite that works like the Google Suite, with many integrated tools: shared files, form creation, calendar, collaborative editing of Office documents… The difference is that the data is hosted on our servers and we promise not to make any commercial use of it 🙂 </div> </div> </div> There’s no limit to the number of users who can be added to Nextcloud, but we do limit disk space: from 20 GB, and up to 500 GB for the moment - we’ll advise if there’s a need to go beyond 500 GB for certain organizations. 🔗</a>Newsletter</h3> </div> This new service</a> allows you to send mass emails, up to several thousand recipients per month - again, we’re starting slowly, so the highest sending limit is only up to 5,000 emails per month. We hope to increase this limit over time! </div> </div> </div> We’re using the free software Listmonk</a> to run this service, on a server we’ve dedicated entirely to it. 🔗</a>PeerTube</h3> </div> We’ve launched our PeerTube</a> to host our conference replays, and at the same time we’re letting other people upload their videos</a>! We offer a fairly large entry-level quota for video hosting, as this is a rather greedy format: from 20 GB up to 1 TB. </div> </div> </div> We can even host a dedicated PeerTube installation</a> for those who wish to do so. 🔗</a>Accounting</h3> </div> Finally, our Accounting service</a> enables associations to carry out their accounting formalities (including the generation of balance sheets and income statements) in compliance with the French associative/non-profit chart of accounts, without any headaches. This service is based on the open-source software Paheko</a>, which we’ve been using in-house at La Contre-Voie since 2019! </div> </div> </div> Finally, as an option, it is possible to request newsletter service integration</a> in Paheko to send subscription reminders and more easily manage the contact base used for mass mailings. 🔗</a>Pricing</h3> We don’t have the resources of Google, which offers its software suite free of charge - at the cost of our privacy - for associations and billions of other people. Nor do we have the resources of Framasoft</a>, which operates thanks to numerous donations and can offer the excellent Framaspace</a> free of charge to over 2,000 associations, with a team of 10 employees. We’re still struggling to pay the people who maintain these digital services for you, and to get the subsidies we’d like - not least because of the lack of budget allocated to public services. We are also finding it difficult to pay for our popular education activities, and to take the step from an association that was initially 100% volunteer. We have therefore decided that these new services, which we call “à la carte” services, will be subject to an annual subscription, the rates for which can be consulted on the page for each of these services. And to avoid falling into the trap of capitalism, we have chosen to offer extensive solidarity-based rates for structures that express a need for them. 🔗</a>Solidary rates</h4> We’ve tried to find fair prices to pay for the upkeep of these services and the people who maintain them. And yet, for many associations, especially those with annual budgets of less than €2,000, these rates can be particularly high, and incomparable to those of the digital giants… We don’t want a structure’s financial capacity to be an obstacle to the adoption of free services; that’s why, if a structure contacts us explaining that its budget doesn’t allow it to finance the services we offer, we’ll adapt our rates to suit its means. We rely on donations to make up the difference between the cost of the services and the actual price paid by the facility. 🔗</a>Other services will not be left out!</h4> For the moment, we’ve prioritized the launch of services for organizations, as this has been a gap to fill in our service offering since the association was created. That said, as we announced</a>, we won’t be abandoning our subscription-based and members-only services: we’re already planning to add a few new features as soon as we’re no longer caught up in the rush of the launch. 🔗</a>Tailor-made digital support</h3> Finally, La Contre-Voie is officially launching its support program, designed to help associations with their digital transition, because providing services is not always enough if the structures using them are not trained in their use and guided in changing their habits. The program includes on-demand training sessions on specific open-source software, data migration assistance and long-term support. Read a testimonial from a successful digital support with a nonprofit in this article</a>! More information to come, but if you’re interested in this program, feel free to contact us</a>. 🔗</a>Timeline</h3> A behind-the-scenes look at the development of this new service offering, which was made possible thanks to you: It’s the culmination of several years’ work, which took place in different stages: the testing of numerous unified authentication solutions (SSO)</a>, which required two years of experimentation and research;</li> the migration of our old members’ area (developed in-house), and the preparatory work that this required ;</li> study and reflection on the technical feasibility</a> of hosting these services: study of the most common needs, moderation, maintainability, compatibility with SSO, rates and comparisons with other hosting providers ;</li> development of a short communication campaign;</li> the development of other necessary software bricks (application portal</a>, front-end</a> and back-end</a> for the mail service, electre</a>, lsforms</a>, keycloak-altcha</a>…).</li> </ul> Thank you for following and supporting us in the creation of these services! Please don’t hesitate to pass on the information to other groups who might need one of our services. We’ll be delighted to give them all the advice and support they need. See you soon! Outcomes, prospects and gifts to associations Unknown — Tue, 24 Dec 2024 10:00:00 +0100 One year after the launch of our roadmap</a>, this article marks a milestone in our actions this year, and introduces the two organizations we have chosen to support financially. 🔗</a>A year to raise a counter-voice</h3> 2024 is another year of organizing awareness-raising activities in community centers, schools, media libraries, and all places that question their use of digital technologies and look for alternatives, or are interested in establishing a healthier relationship with digital tools in general. Even more so today, we are reaching out to “non-geek” audiences, who are unaware of the existence of alternatives, and who may feelwary about using any tool, without any distinction; our role is to help them distinguish between “ethical” and “less ethical” tools, and find satisfactory compromises between their comfort and their control over their own digital data. For this purpose, we have created numerous activity frames</a> in our documentation, which you can freely reuse for your own workshops! </div> Last June, we had the pleasure of being invited by l’Alpha</a>, Angoulême’s media library, to raise awareness of privacy on the Internet. Finally, since September, we’ve been organizing a monthly Apéro Numérique at Le Bêta</a>, in Angoulême, to bring together people who’s either enthusiastic or curious about digital ethics, and thus create a community of mutual aid and sharing of ethical tools. We present a range of topics (attention economy, open-source alternatives, presentation of Paheko…) according to the wishes of participants. </div> </div> </div> Of course, this is an initiative we’d like to continue in 2025, and even expand if we manage to mobilize our volunteers. </a> A poster announcing our Apéros Numériques by @vi_hait (Instagram</a>) </figcaption> </figure> 🔗</a>Technical expansion</h3> As we shared with you in our series of technical articles, we’ve drastically upgraded our infrastructure: we’ve almost tripled our number of servers (from three to eight) and installed our first self-hosted machines</a> ;</li> our “SSO project</a>” is nearing completion, so that our members now use only one account to access all our services (although there’s still some work to be done on this);</li> we’re making progress on industrializing the deployment of our services</a>, so that we can deploy numerous copies of the same service with the least possible effort.</li> </ul> All these transformations and technical improvements offer us new prospects for 2025 : the opening of a new service offering</a> to the public, which we hope to achieve by mid-2025;</li> making this service available to new associations as part of our digital support program</a> (if we manage to support five more associations, that will already be a victory for us!)</li> the inclusion of our services in directories and repositories of structures that support associations, such as Émancip’Asso</a>.</li> </ul> 🔗</a>2024, a year for CHATONS</h3> CHATONS</a> is a collective of hosts of open-source digital services in which we actively participate since 2019. Following on from our commitments in 2023, when we initiated a revision of the CHATONS charter</a>, we committed in our roadmap</a> to participate to the life of the collective, to the tune of one afternoon a week. So we contributed to our sauce in a variety of ways: neil conducted five interviews with CHATONS members</a> on the topic of association wage-earning, a long-term project begun in 2023 ;</li> alex went to the CHATONS Camp and wrote a blog post</a> to share his experience;</li> alex and Denise held a CHATONS presentation conference</a> at the Électrolab, a third-party venue in Nanterre;</li> neil gave a talk at the JDLL on the subject of associative wage-earning among CHATONS;</li> </ul> And in addition, we have collectively participated, in more or less scattered ways, in collective votes, monthly meetings, discussions on the forum</a> and spreading the word about CHATONS in our conferences, workshops and stands throughout the year. </a> L’Antenne, the venue for the CHATONS Camp, which Alex’s report can be read here</a>. </figcaption> </figure> In this way, we feel that we have respected the commitment to resources that we ourselves imposed on the collective. We were also able to witness the empowerment of CHATONS over the course of the year: the collective managed to find a certain stability despite Angie’s departure from the collective’s coordination at the end of 2023, its members mobilizing to ensure self-management of recurring bureaucratic tasks. For our part, in the course of our meetings over the last few years, we’ve come to realize the challenge of reaching out to non-initiated audiences, and the different ways of doing so: making ourselves known outside Mastodon, outside the circles of people who are already convinced, who already share our ideas; integrating networks and federations that are precisely not part of the librist / open-source communities to raise awareness among their members from the inside. So, from 2025 onwards, we will no longer commit ourselves to contributing one afternoon a week to CHATONS, in order to devote this time to contributing to other collectives beyond the librist sphere. Of course, this doesn’t mean we’re disengaging from CHATONS! We remain full members and participants of the collective, and will continue to take part in events to which CHATONS is invited, votes on scopes, working groups, monthly meetings and forum discussions if we have enough volunteering energy to do so (which isn’t always the case, as our time, like everyone else’s, is limited). 🔗</a>Donations for other associations</h3> Once again this year, we’d like to devote part of our budget to supporting other associations that share our values and organize complementary actions. Here are the organizations we have supported in previous years: 2021</a>, 2022</a>, 2023</a>. 🔗</a>A donation for Nos Oignons</h3> Founded in May 2013, Nos Oignons</a> hosts Tor exit nodes</a> to help circumvent Internet censorship, at a time when sites like Wikipedia are banned in many countries such as China</a>, Russia</a> or even Turkey or Venezuela. </a> According to their project presentation page</a>, our donation of 150 € will cover five months of Tor relay operation. Don’t hesitate to complete our donation</a> if their project inspires you! 🔗</a>ALDIL, the JDLL organizer</h3> The JDLL</a>, or Journées du Logiciel Libre (Free/Open-Source Software Days), is an annual meeting in Lyon focusing on digital freedom issues, in which we’ve been participating for several years</a> with conferences, workshops and stands. </a> Our booth at this year’s JDLL! </figcaption> </figure> This annual convention, run by a team of volunteers, had great difficulty</a> finding a new venue this year. ALDIL, a small Lyon-based association founded in 1998, organized the JDLL for 25 years before giving the event its own legal personality</a> at the end of 2023. To this day, it organizes several times a month</a> self-help workshops on free digital technology. It’s this tenacity that we’d like to salute with our modest financial contribution today, with a donation of €150 : let’s not forget the associations that educate, popularize, raise awareness among uninitiated audiences, through a popular education approach: this work in the field, while not always rewarding and recognized, is fundamentally essential to broadening our audiences and Un-google-ify the World™. Through these donations (which equals to around 4% of our gross revenues or 18% of our net surplus in 2024), we hope to nurture solidarity between the various associative players as well as bring visibility to their actions, in the manner of the Copie Publique</a> initiative in the corporate world. 🔗</a>Are we back for another year?</h3> We’re coming to the end of our annual fund-raising campaign, the outcome of which, while still uncertain, will be decisive for the future of La Contre-Voie. You still have one week left before the end of 2024 to place your star on our participative constellation</a>! If you’d like to support us and give us the means to carry out our activities, you can make a donation. On that note, we wish you all the best for the festive season! </div> </div> Drop your star</h3> and donate to La Contre-Voie !</h4> </div> </a> Golden ticket to visit our service factories neil — Tue, 10 Dec 2024 14:45:00 +0200 This is the last article in the series dedicated to La Contre-Voie’s technical infrastructure! Next week, we’ll resume our usual editorial line :) After having presented the hardware</a> used for our computer servers, then the unified authentication</a> module that connects our services together, it’s about time to introduce the software that runs our new services! You will find here</a> the technical documentation we use to maintain our historical services. Meanwhile, our new “à la carte” services</a> are not yet documented as they are not yet officially released: they are used for our experimental digital support program</a> and we hope to officially inaugurate them by mid-2025. In the meantime, in this article, we give you the golden ticket to visit our service factories! Those who follow us will see that our methods have significantly evolved compared to our previous infrastructure. 🔗</a>What’s a service factory?</h3> Sometimes referred to as a service farm or a multi-site deployment, we define it as a set of processes that enable us to effortlessly duplicate a service, hosting it for as many people or organizations as required, while minimizing the cost and time spent on deploying a new clone. Each of these copies of the service separes data and configuration between each organization, but shares other resources: databases, caches, HTTP server, system folders… the aim being to pool as many resources as possible. Sometimes we even pool the software instance while maintaining data separation, in which case we call it a multi-tenant configuration</a>! But this is not always possible with the software we host. To take the example of WordPress</a>: if we need to host 20 organizations, that would initially require us to host 20 different instances of WordPress, which implies keeping them all up to date, configuring them individually, monitoring them… and having sufficient resources (memory, CPU) to host them. Later in this article, we’ll look at how we can technically host 20 organizations with a single instance of WordPress, without compromising on performance or stability, and without running the risk of all 20 websites being unavailable if the single instance goes down! We’ll also present the double challenge of having reproducible instances, but also of integrating OpenID Connect authentication to connect each of these services to our SSO</a>. 🔗</a>Data management</h3> But first, we need to establish how we’re going to store user data. This is the first fundamental building block in creating a service factory: if this part is well thought-out, the service will be easily reproducible later on. Currently, we have eight servers in production. These servers may share the service hosting load between them. We may also need to quickly switch an instance of a service to another server. More commonly still, we might want to separate storage and computation on different machines: one group of machines with lots of storage space whose role is to keep data files and serve as a database, and another group that hosts software instances and various programs that manipulate this data. The challenge is therefore to make the hosted data accessible over the network from another server, and to avoid storing data locally as much as possible. 🔗</a>Database and cache</h4> For the database, it’s easy: with the exception of SQLite, which is out of the game due to its poor performance, all modern DBMS</a> such as PostgreSQL</a> are designed to work over a network. All you need to do is expose the IP and port of the remote PostgreSQL server to the machine concerned, and you’re ready to go. Solutions such as pgpool</a> or pgBouncer</a> can be used to replicate the database on several machines and distribute the load. For caching: we often have to deal with Redis</a>, a high-performance cache that also works over a network. That said, given the very nature of the service (a cache is supposed to be fast and the data hosted on it is likely ephemeral or non-critical), it’s probably more reasonable to host it on the compute server. We’ll then expose it in a virtual network, so that it can be shared between several instances of a service if need be. Real-time replication of Redis data can be achieved using the built-in Sentinel</a> and Cluster</a> features. 🔗</a>User data</h4> By default, most software stores data on the host file system (ext4, btrfs, zfs…), in a Docker volume in our case. This is where it gets complicated (expensive or difficult) if we want to store this data on a remote storage server. There are protocols and tools for serving files over a network such as NFS, GlusterFS, Ceph, ZFS, or even iSCSI or SSHFS, but they all carry their share of constraints and shortcomings: NFS is inexpensive, but doesn’t perform as well as others, and doesn’t handle ownership of files, causing compatibility problems with many software packages;</li> ZFS, GlusterFS and Ceph can quickly consume several GB of RAM and quite a lot of CPU to ensure data duplication;</li> iSCSI is too “low-level” to be useful or efficient and SSHFS is not efficient at all.</li> </ul> After experimenting with NFS for several years, we ended up testing the S3 protocol to create object storage spaces: we use Garage</a>, maintained by DeuxFleurs</a> as an alternative to Minio (also open-source, but Garage is better). Object storage takes a completely different approach to data storage: there is no file hierarchy, and each file is assigned a unique identifier as its filename. These files (then called objects) are kept in “buckets” which constitute the allocated storage space, and are accessed using a key made up of an identifier and a secret. In some software applications, S3 can be chosen as the storage backend for user data. With this storage mode, the remote S3 bucket is served via HTTP. For its part, Garage can be configured to duplicate the bucket in real time across multiple machines. Unfortunately, not all software supports S3. In many cases, it will be necessary to store files on the server hosting the service and find other methods for replication if necessary. We’ll now look at how we can use all these tools to create service factories. 🔗</a>The Nextcloud factory</h3> Nextcloud</a>, the software suite designed for collaborative teamwork that presents itself as an alternative to Google Suite, is a fairly heavy PHP application that can be complex to maintain. It is dependent on a number of small auxiliary services: a Redis cache, a PostgreSQL database, a Collabora Office server, a Cron sidecar, a reverse-proxy… Initially, we started with a single installation of Nextcloud, shared between all our members. But when we wanted to provide services for organizations</a>, we realized that it would not be possible to provide a decent level of service using a single Nextcloud instance shared between all organizations (even using groups</a>): users are not partitioned by organization, configuration is the same for everyone, some data is shared… Furthermore, Nextcloud’s software is not designed to be multi-tenant: we can’t easily use a single instance of Nextcloud to run several different environments with different data and configuration. So we need to do a bit of tinkering to make an instance easily duplicable. And just in time: there’s a recent example of a successful Nextcloud factory, with over 1,500 beneficiary organizations: Frama.space</a>, maintained by Framasoft, which uses a whole panoply of scripts and software to automate the deployment of a new instance very quickly: Charon</a> for registration, Chronos</a> for recurring tasks, a Collabora patch</a>, Asclepios</a> to patch Nextcloud, Argos</a> for supervision, Demeter, Hermes, Poseidon and all the siblings. A video presentation</a> of the internal workings of Framaspace is available on PeerTube, and helped us a lot in thinking about how this factory works. That said, we couldn’t directly reuse Framasoft’s work, as most of the components of this technical stack are intrinsically linked to their infrastructure. So we’re going to have to tinker with Nextcloud in our own way. To understand our approach, let’s start with a standard multi-instance installation: Let’s imagine you’re hosting three instances. The installation on the left is fairly typical of a multi-instance deployment in virtual machines. For three Nextcloud instances, there are three instance-specific services: the HTTP server, the PHP-FPM server and the Cron sidecar. Sometimes, the three services are merged into one, especially when using the Nextcloud apache</code> image and the webcron</a>… but this has a major impact on Nextcloud performance. With this, we also have two additional services which are not specific to Nextcloud but on which Nextcloud depends: the PostgreSQL database and the Redis cache (the latter is optional but greatly improves performance). Next, each instance will have three volumes : the installation folder, mounted on /var/www/html/</code>, which contains Nextcloud’s system files and weighs around 1 GB ;</li> the lightweight configuration folder, mounted on /var/www/html/config/</code>;</li> the data folder on /var/www/html/data/</code>.</li> </ul> And finally, not listed here, but other auxiliary services may be required: the Collabora Office server (or Onlyoffice) for collaborative editing of Office documents;</li> the TURN/STUN server to use Nextcloud Talk ;</li> an Imaginary server to generate thumbnails ;</li> other third-party services.</li> </ul> As you can see, this leads us to maintain a very substantial number of services per instance. For our part, we’re starting from the installation on the right, which is still fairly common, by mutualizing certain resources: the database and cache are shared ;</li> our reverse-proxy Caddy</a> is shared by all our services and serves files directly from the Nextcloud instance.</li> </ul> But this level of mutualization is not yet sufficient for our taste, as soon as we want to host several Nextcloud instances. 🔗</a>Data</h4> S3 makes this part very simple: we can create one bucket per instance and store data inside. Thus, the data volume disappears and is replaced by an additional service, Garage, accessible over the network. 🔗</a>The installation folder</h4> The installation folder is the volume in which Nextcloud stores its system files: its components, its plugins… all the “heart” of Nextcloud is kept inside. The files stored inside don’t move unless Nextcloud or its plugins are updated. So, for three Nextcloud instances of the same version and with the same plugins, the installation folder will be identical. This is interesting, because it means there’s a way to mutualize this resource between instances. It’s even more interesting to share this folder since it weighs in at 1.2 GB per instance. Unfortunately, Nextcloud doesn’t like the idea at all: every time it starts up, it performs a few disturbing operations: it uses a file to lock the folder for writing and will refuse to start up if this lock file is present, meaning that another instance is using it;</li> it attempts to update the files in this folder if it detects that an update is available… but this will necessarily impact other instances.</li> </ul> So we patched</a> the Nextcloud startup script to disable all Nextcloud interactions with this folder. This gives us the following configuration: Left: installation without sharing the installation folder. On the right, our final configuration. We still have a few areas for improvement: to avoid all cron of our Nextcloud instances occurring at the same time and overloading the server, we could see to what extent we can reuse Chronos</a>, used by Framaspace to create a “cron queue”, for this purpose;</li> we could theoretically use a single instance of PHP-FPM by changing the configuration folder according to the host name as Framaspace does (as shown in their video), and thus achieve a truly multi-tenant installation ;</li> we need an Imaginary server instance to offload the PHP server on thumbnails generation ;</li> we will likely need a patched Collabora instance at some point.</li> </ul> Note that our installation folder is mounted read-only on our instances. 🔗</a>Configuration</h4> Finally, all that’s left is the configuration volume, which contains less than 5 Kb of files… which we haven’t yet managed to relocate. But as it’s a very small volume, it’s not a big deal. On the other hand, we need to add a few parameters so that our tweaking of the installation folder doesn’t cause any problems: updatechecker’ => false,` to disable checking for new updates (we’ll take care of that ourselves);</li> appstoreenabled’ => false,` to disable installation and updating of applications via the Nextcloud store.</li> </ul> For the rest of the configuration, we’ll use the environment variables to provision a new installation with the desired configuration: POSTGRES_*</code> to configure a new database;</li> SMTP_*</code> and MAIL_*</code> to configure e-mail sending;</li> OBJECTSTORE_S3_*</code> for data storage;</li> NEXTCLOUD_TRUSTED_DOMAINS</code> and TRUSTED_PROXIES</code> for the reverse-proxy and hostname configuration;</li> REDIS_HOST_*</code> for the Redis cache;</li> NEXTCLOUD_ADMIN_*</code> to create an administration account;</li> NEXTCLOUD_UPDATE=0</code> to disable Nextcloud update at startup;</li> NEXTCLOUD_DATA_DIR=/data</code> as a fake data volume to which we add a .ocdata</code> file. As the data is stored in the S3 bucket, the data folder is of no use to us.</li> </ul> 🔗</a>Plugins</h4> We add and configure two additional applications to Nextcloud: the Collabora Office</a> app for collaborative document editing;</li> the OpenID Connect</a> app to connect Nextcloud to our authentication provider</a>.</li> </ul> 🔗</a>Maintenance</h4> Now that we have a complete installation, let’s see how we can simply add a new instance and update applications. To deploy a new instance: we use an ephemeral Nextcloud container to initialize the configuration folder, the S3 bucket and the database; it uses the official image (and not our patched image), so it will perform the entire initialization and update process. Once initialized, we stop the container and add the new instance to our Nextcloud cluster with the other instances we host, on our Core repository</a>. To perform a Nextcloud or application update: we switch all instances to maintenance mode, then use an ephemeral container that uses the official image to update the Nextcloud installation folder, which is mounted as read-write on this container. This procedure updates all instances simultaneously. Once the update is complete, we use the command ./occ upgrade</code> on each instance to update each of the databases, then deactivate maintenance mode. 🔗</a>The Paheko factory</h3> For Paheko</a>, free accounting and membership management software, the process is a little easier but required a lot of preparation. The software natively</a> supports multi-tenant installations, but we had to do a lot of fiddling: Paheko provides a specific configuration file</a> for this kind of installation, and the usual scripts (for crons, emails) are different from a usual installation. In short: it’s supported, but you’ll have to graft the necessary modules yourself, and probably touch up the PHP code a bit. We’ve created a Docker image for Paheko</a> which has several advantages over a conventional installation: the instance is designed to be multi-site, so there’s no need for fiddling ;</li> domain names are fully customizable: with the configuration file supplied, it was only possible to create sub-domains (e.g.: myorg.paheko.cloud…).</li> we use a PHP-FPM alpine image rather than an Apache server, enabling us to serve Paheko with our Caddy reverse-proxy in HTTP/3 without passing through an intermediary HTTP server, and offering performance gains;</li> native integration of system crons;</li> the container is not privileged, nothing runs as root (not even cron or PHP-FPM server);</li> our image supports mass e-mailing and bounces management (e-mails returned to sender);</li> configuration can be provisioned with environment variables</a>.</li> </ul> 🔗</a>SSO configuration</h4> Paheko allows the software to be used with an SSO, but this does not mean that the software supports an SSO. A wiki page</a> is dedicated to this. To put it simply: you have to write your own SSO integration in PHP. This isn’t easy or accessible, and we didn’t have much time to devote to it, so we opted for another choice: using a generic admin account. Everyone who has been granted access to their organization’s accounting instance is therefore admin. This means there is no nominative history of actions, which is still rather problematic for accounting purposes, but we live with this compromise. True SSO management is actually handled by the caddy-security plugin</a>, which we use as an OIDC authentication wall, and which checks whether the user has the right roles to access the accounting system. Finally, we don’t use Paheko at all to manage OIDC. 🔗</a>Paheko’s shortcomings</h4> Paheko has the advantage of being very light and efficient in terms of resource consumption (absolutely nothing to do with Nextcloud). A single instance of the software can host several organizations without a hitch. There are, however, several notable drawbacks: Paheko only supports SQLite. This does not pose any performance problems, but makes it difficult to conceive a highly available / distributed installation on several servers. The volume containing user data can quickly weigh several GB, and synchronizing it in real time from one server to another can prove complicated as we wrote above</a>. Paheko does not support the S3 protocol. Files (and in particular accounting attachments) are either integrated into the SQLite database (which won’t make it lighter…), or managed on the host’s file system. This brings us to the same constraints as above: it’s hard to imagine a highly available server in this configuration. Third-party authentication sources are not well integrated. As we wrote above, integrating an SSO is more a matter of tinkering than software integration, and has led us to make compromises. These weaknesses are offset by the simplicity of data storage and maintenance management: Paheko relies on a rather “old-school” (monolithic) management of storage space and data, but everything rests in a single volume. Even if you have to host 50 organizations, there will always be only one volume to back up. This is a far cry from the headache of hosting a Nextcloud cluster. Updating all Paheko instances remains extremely simple: on our side, all we have to do is change the version number and regenerate our Docker image, and the instances will update themselves in turn the next time their users visit. Beware, however, of updates that break the installation; fortunately, the changelog</a> is well written. To create a new instance, nothing could be simpler: just create a folder with the domain name of the new instance in the Paheko volume, folder users/</code>. We then configure the caddy-security module for SSO management. 🔗</a>The WordPress factory</h3> WordPress (https://wordpress.org/) is the world’s most widely used web design software (no less), and it’s free (yay). Thanks to its maturity, WordPress has long included Multisite</a> functionality for setting up a multi-tenant instance. Because WordPress is so widespread, it’s particularly dangerous to host, as any security vulnerability found is quickly exploited. Having a Multisite instance greatly simplifies maintenance: instead of having to update each instance individually, we can simply keep the single Multisite instance up to date. Another great advantage of this configuration is that the Multisite functionality is really designed to simplify the deployment of a new site with just one click. It’s even simpler than with Paheko, since it can be done via the web interface. However, this environment comes with its own set of disadvantages. 🔗</a>The disadvantages of Multisite installation</h4> Plugin and themes locked. For our users, it’s not possible to install new themes or custom plugins. Given that most of the security flaws in WordPress come from plugins, this should be seen as an advantage… but it’s still a constraint. As for themes, we have pre-installed about thirty popular themes, and if the organizations we host want a particular theme, they can ask us to install it. One security flaw compromises all websites. If a security flaw is discovered in one of our hosted sites, it’s quite likely that the other sites will also be compromised. Traffic surges: if one of the hosted sites has a traffic peak, the other sites will be slowed down too. Everything rests on one instance. If the Multisite instance goes down, all the sites go down with it. We’re now going to show you the workarounds we’ve found to avoid these inconveniences. 🔗</a>Staatic to counter the disadvantages</h4> Staatic</a> is a WordPress plugin that lets you create a static site from a WordPress site. It works by indexing the website and then uploading it to the desired storage medium (S3, local folder, FTP, GitHub Pages…). We have naturally chosen S3 as the destination medium. Publishing a site is triggered manually, by pressing a “Publish” button in a website’s administration interface; the WordPress site itself then becomes a pre-production space for our users before sending the site to the S3 bucket. Our S3 server, Garage, can be configured to serve the content of an S3 bucket via HTTP without authentication. Our blog (this very website) and our our documentation</a> is served that way; in parallel, it duplicates in real time the websites it hosts on three different servers, enabling traffic load balancing if required. So, in the event of a failure of the WordPress multisite instance, the site administration space will be unavailable, but nothing else will move: sites will remain online, since they are hosted on Garage. Furthermore, static sites are inherently much faster than classic WordPress sites. HTML pages are served directly, without being processed by a PHP server. And finally, in terms of security: there’s no need to expose the WordPress instance itself, since it’s simply used to design the site, not to serve it directly to the people who are going to consult it. We can therefore set up an authentication wall across the entire WordPress instance. The only major drawback of this configuration is the impossibility of hosting dynamic content on the site. No contact form, reservation plugin, or other potentially interesting uses: it’s fine for a showcase site or a blog, but you quickly reach its limits. But it also simplifies maintenance and drastically reduces the attack surface: it’s the best compromise we’ve found. Of course, as part of our web hosting package, we’ll also offer</a> to host a raw S3 bucket, without WordPress, to serve a static site for geeks who know how; but that doesn’t concern the majority of the audience we’re aiming to reach. 🔗</a>Other software in our stack</h3> We’ve covered the three softwares for which we’ve achieved the best results after several months’ work, but we’ve also improved other aspects of our software infrastructure that we’d like to introduce to you. 🔗</a>Listmonk</h4> We are fortunate to be able to take immediate advantage of the new version of Listmonk</a>, which now supports multi-user usage and integrates OpenID Connect. The software is used to send newsletters, which Paheko already allows, but the uses may vary. Listmonk also supports an S3 backend for hosting e-mail attachments. 🔗</a>MX secondary and newsletters</h4> By tweaking</a> a new instance of docker-mailserver</a>, which we’ve been using for 6 years to host our e-mails, we’ve set up a secondary mail server that can receive e-mails if the main instance goes down. This instance is hosted on a dedicated server (stanley). This secondary server is used by Paheko and Listmonk to send mass e-mails, rather than our main server: indeed, sending mass e-mails immediately causes a slowdown in e-mail distribution due to rate limits imposed by the giants (in particular Google). So, to prevent all our members’ mailboxes from being temporarily blocked (for several hours!) by Google, we use this secondary server which will be subject to the rate limit instead of our main server. For the same reason, earlier this year, we were forced to limit the usage</a> of our mail service</a> to prevent associations from using it to send emails to dozens of people at the same time (which led to delays in distribution), and to encourage them to use a newsletter service for this purpose, whether ours or elsewhere, with the sole aim of ensuring the proper distribution of correspondence from our members. 🔗</a>Domain name management</h4> To simplify the work of some of the organizations we support, we sometimes intervene directly on the domain names of organizations that have given us their consent. For the time being, we use HappyDomain</a> to manage their DNS zones. HappyDomain works by retrieving API rights from registrars and supports many providers… But this software is not very mature, contains bugs and seems poorly maintained</a>, which encourages us to look for alternatives. 🔗</a>Internal supervision</h4> We reworked our internal supervision this year: we left Netdata, which is changing its license</a> and now incorporates pieces of proprietary code, and migrated to a Telegraf + InfluxDB + Grafana stack. This stack is working perfectly so far. Alex, a member of our Contribution Committee, held a conference</a> on the subject at the Capitole du Libre 2024. 🔗</a>Mail service</h4> We’ve considerably improved our mail service this year, partly through the integration of our secondary MX mentioned above, and partly through the addition of a new webmail that runs on Roundcube</a>. We’ve still got a nice present in store for our members for next year: Hannaeko and Neil are working on a new software brick that will replace the interface we use today to add aliases and mailboxes with a new, updated piece of software that will use OpenID Connect to authenticate members. We also hope that this project can be used by developers and users of docker-mailserver</a> as an API and frontend for using the service. 🔗</a>CI/CD and Docker images</h4> Finally, in the last big news of the year, we’re using one of our new Beta servers (monacha) to run CI/CDs on our repositories using the Gitea-forked runner act</a>. This new tool allows us to automatically deploy this website</a>, our documentation, and also recompiles our binaries including (rs-short</a>, autodiscover</a> or constello</a> with each new commit on the main branch. It generates a Docker image for each of these software packages, which are hosted on our forge</a>. This greatly simplifies update deployments: gone are the days when we compiled production binaries on our computers! We now have a server for that. 🔗</a>What’s next?</h3> To conclude this series of three lengthy articles (over an hour’s reading in total?!) on technical improvements at La Contre-Voie, here’s our plan for the year ahead. 🔗</a>Expand</h4> First of all, we’re going to continue expanding our service offering as we’ve previously announced</a>: we’re going to use all these new servers</a> to host our new tools, starting with the a la carte services (including PeerTube, which isn’t up and running yet), then adding the free of charge services (under registration) that we’d like to make available to you. At that point, we’ll (finally!) migrate our old member service to our new SSO</a> after completing the various technical prerequisites for this migration (captcha development, membership management in Keycloak, deployment of the new mail service interface and integration of our historical Git and Nextcloud services). On this basis, we will build a free-to-use service offering (financed by your donations and our other actions), unified and requiring only the creation of an account on our SSO. 🔗</a>Consolidate</h4> Next, we’ll be working on the finishing touches to this service offering adding the missing cogs. In bulk: writing a membership management tool for us, developing a rights management tool so that our beneficiary organizations can administer their teams, writing configurations to improve supervision of our services, contributing to tools we use… We’ll also take some time to take stock of our previous service offering, in place since 2019: what to do with sncf</a>, the tool behind our Forms service</a>, which we no longer have the time to maintain? What direction should we take for our Draw service</a>, which is really little used, or our Links service</a>, which regularly hosts phishing links and costs us moderation time? We’ll take the time to take a step back and adapt our trajectory accordingly. Finally, this consolidation will also take place behind the scenes: we’ll be reviewing the distribution of these services across our various servers to create real-time data redundancy, guard more effectively against the risks of hard disk failure, automate update and maintenance processes, take the time to do things right even if it means slowing down a little. The work of consolidation is rather unrewarding (we don’t launch a new service, it’s maintenance) and rather invisible (we won’t announce that we’re maintaining a service, it’s what’s expected of us, it’s considered a due), and yet it’s an absolutely essential step. 🔗</a>Documenting</h4> In parallel with this consolidation work, we will continue to document and explain our approach, on our documentation</a> as much as on this blog (although our publications are quite irregular…), to spread our knowledge as widely as possible, throughout the transformation of our services. Last year, we had already devoted a lot of time</a> to our documentation platform, and we will continue to enrich it over time. 🔗</a>… if we manage to exist</h3> There are only a dozen of us, with one full-time volunteer who has been with us for 6 years - and who can’t stay just a volunteer for much longer. Three years ago, we were still starting with a annual budget of €2,000, and yet today we still persist in the idea that we can crank up the speed and start paying a salary, to help as many people as possible evolve their digital practices. We don’t yet know whether we’ll have the financial means to reach the €12,000 goal of our donation campaign which, if supplemented by membership fees, grants, paid educational interventions, hosting services and other sources, will perhaps give us the capacity to pay a full-time SMIC. Would you like to support us in achieving this? If you’ve enjoyed reading these articles, if you think it’s worth a try, if you’d like to read us again, then you can make a donation: </div> </div> Drop your star</h3> and donate to La Contre-Voie !</h4> </div> </a> It’s thanks to you that we’re where we are. Thank you for your support, and see you next week for another article, less technical this time! A comparison of eleven open-source SSO solutions neil — Fri, 06 Dec 2024 11:45:00 +0200 In this second article, dedicated to the management of our technical infrastructure, we present our research work on unified authentication solutions for the sake of transparency and spreading knowledge. As you can imagine, these articles are exceptionally aimed at an expert audience, but you can also find our article on our digital support program</a> or our new service offering</a> if you prefer to read more accessible content. This article follows the presentation of our hardware</a> in which we showed the servers we self-host, and will be completed by an article on the industrialization of our “à la carte” services. Are you too looking for an SSO solution for your digital services, but don’t know which software to try out first? Well, we’ve wasted a lot of time on the question, so you’ll be able to benefit from our feedback! SSO (Single Sign-On) is the tool we wanted to setup in order to centralize authentication across all our tools via a single platform, so that users would only have to log in once, with a single account, to access services; just like a Google account that gives access to all Google services (Drive, Docs, Forms, Calendar…). It emerges from a need we’ve had since 2019 with our members: once their account has been created on the member area, our members then still have to create an account on Nextcloud, then again a new account on Gitea… a long and off-putting procedure in short. We had put in place a number of features to facilitate the creation of these accounts, but it was essentially fiddling with the software’s administration API; in short, the compromise was unsatisfactory, and deterred us from adding new services for a long time. So, after a few years in operation, we set out to find SSO solutions. 🔗</a>Warning: we don’t have all the answers!</h3> This article is not intended to be a repository of free SSOs. It reflects our own research experience and represents the groundwork that we collectively carried out since early 2023. We took more than a year to test, contribute, improve and then choose our solution. </a> You won’t believe what we’ve been through to reach this conclusion… </figcaption> </figure> Some solutions have improved since our tests, and have integrated features that were important to us and weren’t there when we tested the software. We will not be updating this article as these solutions improve. If, however, you feel that having an updated comparison of free SSOs would be relevant, we encourage you to create your own SSO comparison sheet which will undoubtedly be of great help to structures looking for them; feel free to use our feedback as a basis for this. And finally, we’re writing this article with the obvious biases of the young innovative solutions enthusiasts that we are: a penchant for sobriety (memory, CPU) ;</li> not too keen on maintaining an LDAP directory;</li> an appetite for modern, streamlined graphical interfaces;</li> and a small preference for modern languages (Go, Rust…) over older ones (Java, Perl), without this weighing too heavily in our judgment, and without wishing to reignite a language war.</li> </ul> We don’t claim to be impartial, so please take our feedback with a grain of salt! 🔗</a>Our criteria</h3> We had a pretty clear idea of what we wanted, which is perhaps why the search turned out to be so inconclusive. Our major constraints: The solution must of course be free and open-source: this eliminates a good number of options, starting with Microsoft Active Directory and Okta/Auth0</a>.</li> It must be possible to import our existing database: the passwords in our initial database are hashed with bcrypt</code>, and we don’t want to ask all our members to reset their passwords;</li> The solution must support the OpenID Connect (OIDC) protocol as a provider, not necessarily as a client. We want to authenticate all our tools via OIDC.</li> The software must be actively maintained or developed;</li> The memory footprint of the solution must be small:</li> no more CPU than a simple web application;</li> no more than 500 MB RAM for SSO and OIDC support, and ideally less than 150 MB.</li> </ul> Our secondary constraints: Complete management of the authentication workflow: login, forgotten password, change of e-mail address and username;</li> Complete registration workflow: account creation, e-mail address validation, open-source captcha ;</li> Two-factor authentication (TOTP);</li> Works autonomously with its own database: does not require LDAP (PostgreSQL works for us);</li> Translates at least into English and French ;</li> System of permissions / access restriction to certain services based on group membership: for example, users in an “admin” group would connect to certain services inaccessible to others.</li> </ul> Our bonuses: Customizable fields at registration: fields can be added for each user, and some can be deactivated (notably first and last name fields).</li> Integrated (but deactivatable) member area with customizable options: access portal to services, possibility of displaying membership status with customized code snippets…</li> Works in total autonomy: a single container for everything, or in a pinch two containers: one for SSO and one for OIDC, for example. The database can be separated as well.</li> </ul> We’ll see later that some secondary constraints became primary ones, and other major criteria were ultimately de-prioritized. 🔗</a>In-house software</h3> At the outset, we briefly considered the idea of developing in-house software dedicated to authentication. We have some knowledge of Rust</a>, several projects using the Actix</a> web framework and authentication requires relatively few web pages to be designed - we could have started with our own tool. But two caveats made us change our minds… OpenID Connect handling. There’s a Rust package for creating an OIDC server called oxide-auth</a>, but it’s not under active development and lacks crucial OIDC protocol features; in short, it’s rather incomplete and poorly maintained. We could have re-implemented OIDC ourselves, but that would have meant an additional workload. The authentication and registration flows. As we formalized our criteria, we realized that writing this tool would be quite complex if we wanted it to be complete: registration requires sending a confirmation e-mail, authentication might require implementing TOTP, we might want to implement a captcha… add to that localization (translation), management of forgotten passwords, permissions… and it’s getting to be a lot for our shoulders. 🔗</a>Keycloak</h3> We already knew Keycloak</a> - it’s the best-known open-source solution when it comes to SSO. We can’t miss it. A leader in its field, Keycloak is an all-in-one solution, supports all essential standards, is packed with features… But that’s also one of its shortcomings: there are so many features in the software that it becomes a gas factory. But that didn’t stop us from trying out the tool. In 2023, we tested Keycloak in version 22.0.1, with the official Docker image weighing in at 441 MB - far too much for our liking. Starting a Keycloak development instance (based on the instructions given on the README</a>) sets the tone: NAME CPU % MEM USAGE / LIMIT NET I/O BLOCK I/O PIDS keycloak 0.64% 469.3MiB / 800MiB 1.05kB / 0B 165MB / 179MB 45</code></pre> Barely launched, the container already consumes 470MB of RAM, which seems outrageously high to us. The software is written in Java, and that didn’t appeal to us at all. We wanted a lightweight solution, in a modern language, with just enough functionality for our needs. Keycloak is the exact opposite of that description. So we set out to find alternatives to Keycloak… and at the end of the article we’ll explain why we finally reverted to this choice. Criteria</th> Keycloak</th></tr></thead> Free / open-source</td> ✅ Apache 2.0</td></tr> Lightweight (RAM)</td> ❌ approx. 500 MB</td></tr> Lightweight (image)</td> ❌ approx. 500 MB</td></tr> Lightweight (CPU)</td> ✅ Pretty much OK</td></tr> OIDC support</td> ✅</td></tr> Reliable backend other than LDAP</td> ✅</td></tr> bcrypt password support</td> ✅</td></tr> Login form</td> ✅</td></tr> Registration form</td> ✅</td></tr> Validation by mail</td> ✅</td></tr> Password recovery</td> ✅</td></tr> 2FA TOTP</td> ✅</td></tr> Open-source captcha</td> ❌ No open-source captcha</td></tr> Localization (FR/EN)</td> ✅</td></tr> CSS customization</td> ✅ To some extent…</td></tr> RBAC (permissions)</td> ⚠️ Does not restrict access to apps</td></tr> Integrated member area</td> ✅</td></tr> Simple to deploy</td> ✅</td></tr> Customizable fields</td> ✅ Highly customizable</td></tr> Active development</td> ✅</td></tr> Software reputation</td> ✅ 23.6k stars, leader</td></tr> Language</td> ❌ Java</td></tr> </tbody></table> 🔗</a>Authelia</h3> We quickly found Authelia</a>. Written in Go - a modern, disruptive language - the software consumes less than a hundred MB in RAM. Its Docker image weighs in at just 20 MB, and its beautiful design and light weight are highly appreciated. Despite this, we have identified two blocking factors… It requires an LDAP directory. Despite its air of modernity, Authelia supports only two types of database for authenticating users: LDAP</a>, for which OpenLDAP</a> can be used, but which our reluctance to maintain an LDAP directory prevents us from choosing;</li> a YAML configuration file</a>, in which users are added manually (which is handy for testing, but not at all for production).</li> </ul> No registration form. To create an account, an admin must intervene, and accounts cannot be created by users on their own. There isn’t even an administration interface</a>, you have to modify the LDAP or the YAML file. But we persisted with Authelia. In April 2023, we came up with the crazy idea of creating a small software program</a> to serve as a registration form and administration interface, which would add and modify entries in the YAML file of the users we planned to use in production. Denise and Monique were on the project, but we ended up abandoning this rather convoluted idea. We also observed in the responses to the project’s tickets</a> that developers are very reluctant to accept modifications to their code (in particular, authentication backends other than LDAP) “for security reasons”, leaving us little room for contribution should the need arise. Criteria</th> Authelia</th></tr></thead> Free / open-source</td> ✅ Apache 2.0</td></tr> Lightweight (RAM)</td> ✅ Less than 100 MB</td></tr> Lightweight (image)</td> ✅ Less than 50 MB</td></tr> Lightweight (CPU)</td> ✅ Fast and sober</td></tr> OIDC support</td> ✅</td></tr> Reliable backend other than LDAP</td> ❌ YAML doesn’t count!</td></tr> bcrypt password support</td> ✅</td></tr> Login form</td> ✅</td></tr> Registration form</td> ❌</td></tr> Validation by mail</td> ✅</td></tr> Password recovery</td> ✅</td></tr> 2FA TOTP</td> ✅ WebAuthn too</td></tr> Open-source captcha</td> ❌ No captcha</td></tr> Localization (FR/EN)</td> ✅ Yes</a></td></tr> CSS customization</td> ❌ Requires binary recompilation</td></tr> RBAC (permissions)</td> ✅ Yes</a></td></tr> Integrated member area</td> ❌</td></tr> Easy to deploy</td> ✅</td></tr> Customizable fields</td> ❌</td></tr> Active development</td> ✅</td></tr> Software reputation</td> ✅ 21.8k stars</td></tr> Language</td> ✅ Go</td></tr> </tbody></table> 🔗</a>Authentik</h3> Authentik</a> stood out in our searches, notably because it compares</a> itself ostensibly to Keycloak and Authelia on its homepage, boasting its many features. And there’s a lot to like: this SSO solution features a account creation form and even seems to be able to dispense with an LDAP directory altogether, using its own database. It also makes it fairly easy to modify the pages served - adding CSS sheets is very straightforward. Written in Python, this program seemed to have everything to please. The only drawback at first glance is that it integrates a captcha system, but only supports proprietary captchas (hCaptcha, reCAPTCHA…). We might consider developing our own integration if the need arises. We have therefore tried to set it up. Installation requires a PostgreSQL database and a Redis cache. It is necessarily deployed in two containers: a server and a worker. The size of the ghcr.io/goauthentik/server</code> Docker image is initially rather surprising: 802 MB in its 2023.6.1</code> version, making you wonder what could be taking up so much space inside. Deployment then reveals Authentik’s true nature: NAME CPU % MEM USAGE / LIMIT NET I/O BLOCK I/O PIDS authentik-worker 0.05% 401.8MiB / 500MiB 582kB / 516kB 115kB / 0B 9 authentik-server 1.11% 473.2MiB / 500MiB 390kB / 244kB 25.2MB / 0B 21 authentik-redis 0.27% 4.258MiB / 300MiB 8.58MB / 3.54MB 4.71MB / 86kB 5</code></pre> Despite the RAM limit of 500MB on both containers, they each reserve a minimum of 400MB of RAM upon launch: the containers have just been restarted and no web page has yet been consulted. It’s a great example to show that an application can be greedy without being written in Java: this software consumes at least twice as many resources as Keycloak. Criteria</th> Authentik</th></tr></thead> Free / open-source</td> ✅ MIT</a> (for the free version)</td></tr> Lightweight (RAM)</td> ❌ 800+ MB idle: monstrous</td></tr> Lightweight (image)</td> ❌ 800 MB: mammoth</td></tr> Lightweight (CPU)</td> ❓ Not tested</td></tr> OIDC support</td> ✅</td></tr> Backend other than LDAP</td> ✅ PostgreSQL</td></tr> bcrypt password support</td> ❓ Untested</td></tr> Login form</td> ✅</td></tr> Registration form</td> ✅</td></tr> Validation by mail</td> ✅</td></tr> Password recovery</td> ✅</td></tr> 2FA TOTP</td> ✅</td></tr> Open-source captcha</td> ❌ reCaptcha / hCaptcha</td></tr> Localization (FR/EN)</td> ✅</td></tr> CSS customization</td> ✅</td></tr> RBAC (permissions)</td> ✅</td></tr> Integrated member area</td> ❓</td></tr> Simple to deploy</td> ✅</td></tr> Customizable fields</td> ❓</td></tr> Active development</td> ✅</td></tr> Software reputation</td> ✅ 13.6k stars</td></tr> Language</td> ✅ Python</td></tr> </tbody></table> 🔗</a>Ory</h3> Another popular solution is called Ory</a>, with its components Hydra</a> and Kratos</a>. Written in Go and incorporating a registration form, it looks naturally attractive… until it’s time to deploy it locally. Denise, a member of our Contribution Committee, has deployed a functional instance</a> of the software. Its RAM consumption is quite low. It requires four containers: ory-kratos</code>, the identity server, which manages the user directory and interfaces with the PostgreSQL database (which you’ll need one more container for).</li> ory-kratos-ui</code>, the identity server’s graphical interface.</li> ory-hydra</code>, the OpenID Connect module that uses Kratos as an authentication backend.</li> ory-hydra-consent</code>, the Hydra module that displays an interface to request user consent when accessing an application.</li> </ul> Setting up these containers is a pain, Denise had to recompile each module and rewrite a Dockerfile to achieve a working configuration. The configuration files are not easy to get to grips with (especially the identity file</a>). And here’s the icing on the cake: at the time of testing, it was not possible</a> to translate the software without forking another module, ory/elements</a>. In short: even if it consumes few resources, this solution is a real gas factory, and it would seem that the whole installation procedure is there to dissuade us from self-hosting it and going for the paid solution, hosted by the company. This is the conclusion we came to in March 2023. Criteria</th> Ory / Kratos / Hydra</th></tr></thead> Free / open-source</td> ✅ Yes (for the free version)</td></tr> Lightweight (RAM)</td> ✅ Yes (less than 150 MB)</td></tr> Lightweight (image)</td> ✅</td></tr> Lightweight (CPU)</td> ✅</td></tr> OIDC support</td> ✅</td></tr> Backend other than LDAP</td> ✅</td></tr> bcrypt password support</td> ✅</td></tr> Login form</td> ✅</td></tr> Registration form</td> ✅</td></tr> Validation by mail</td> ✅</td></tr> Password recovery</td> ✅</td></tr> 2FA TOTP</td> ✅</td></tr> Open-source captcha</td> ❌ No captcha</td></tr> Localization (FR/EN)</td> ❌ Not available at time of testing</td></tr> CSS customization</td> ❌ Recompilation required</td></tr> RBAC (permissions)</td> ❓</td></tr> Integrated member area</td> ✅</td></tr> Simple to deploy</td> ❌ Hell on Earth</td></tr> Customizable fields</td> ✅</td></tr> Active development</td> ✅</td></tr> Software reputation</td> ✅ 15.6k stars</td></tr> Language</td> ✅ Go</td></tr> </tbody></table> 🔗</a>Casdoor</h3> During our research, we came across the awesome-auth</a> page, which lists open-source authentication solutions. Casdoor is systematically listed first in many categories. We quickly realized that Casdoor</a>, an open-source SSO, is a related project to Casbin</a>, and that the developers of both are the owners of the awesome-auth repository. They have therefore positioned themselves as the first alternative everywhere, to promote their solution… Despite what we consider to be a lack of honesty on their part, we gave their solution a try. Their documentation is rather poorly written, apparently badly translated from Chinese, which caused us some difficulty in configuring Casdoor. But once configured, the software was a dream: it had almost all the functionality we needed! And the missing solutions seemed easy to integrate, as the software is highly modular. The software’s RAM consumption is negligible, and some particularly interesting features not found elsewhere were well thought-out (integrated payments, multi-organization management, etc.). New versions are frequent, and the added features are relevant. Neil even ended up presenting Casdoor at Camp CHATONS 2023 as an excellent solution. Among the things missing: The French translation was very bad (Home</code> translated as Maison</code> (house) rather than Accueil</code> (welcome page)…), which is why we mobilized to contribute to the translation on their Crowdin</a>.</li> There’s a free captcha, but it’s not very secure; we wanted to integrate mCaptcha</a> by contributing to the code, which seemed rather accessible as the code is very modular and their software already supports many captchas.</li> </ul> Then, little by little, we began to discover the negative points of this solution. The first negative point: new versions are far too frequent</a>. There is generally one new version per commit. Versioning is chaotic, not a semantic versioning</a> but a somewhat abstract variant that doesn’t seem to make much sense. In three months, the software changes so much that there’s a lot of reconfiguration work to be done, and updates break the installation quite regularly. In addition, we identified several security problems with Casdoor, starting with its password retention policy: the software supports numerous password derivation algorithms (including bcrypt</code>), but stores passwords in clear text by default, at the time of our tests. On the other hand, Casdoor disseminates a lot of information through its API, sometimes sensitive information. Hannaeko, a member of our Contribution Committee, spotted a rather serious flaw: the response of all the software’s capatchas is disclosed via the API</a>… The bug was solved a month and a half later, but we had already decided on another solution, as we weren’t entirely convinced by the quality of the code and the features stability. Criteria</th> Casdoor</th></tr></thead> Free / open-source</td> ✅ Yes (for the free version)</td></tr> Lightweight (RAM)</td> ✅ Yes (less than 150 MB)</td></tr> Lightweight (image)</td> ✅ Yes (45 MB)</td></tr> Lightweight (CPU)</td> ✅</td></tr> OIDC support</td> ✅</td></tr> Backend other than LDAP</td> ✅</td></tr> bcrypt password support</td> ✅</td></tr> Login form</td> ✅</td></tr> Registration form</td> ✅</td></tr> Validation by mail</td> ✅</td></tr> Password recovery</td> ✅</td></tr> 2FA TOTP</td> ✅</td></tr> Open-source captcha</td> ✅ Yes, but easy to break</td></tr> Localization (FR/EN)</td> ⚠️ Yes, but needs work</td></tr> CSS customization</td> ✅</td></tr> RBAC (permissions)</td> ✅ Quite complex to set up</td></tr> Integrated member area</td> ✅</td></tr> Simple to deploy</td> ✅ Yes, despite poor documentation</td></tr> Customizable fields</td> ✅</td></tr> Active development</td> ⚠️ Yes, but release of new versions is chaotic</td></tr> Software reputation</td> ✅ 10.2k stars</td></tr> Language</td> ✅ Go</td></tr> Blocking points</td> ❌ Security taken lightly, little stability between updates</td></tr> </tbody></table> 🔗</a>Zitadel</h3> We also tested Zitadel</a>, which presents itself as an emerging alternative to other SSOs and seems to be improving (very slowly) over time. Very good points: it integrates a registration form and works with PostgreSQL, and it’s relatively lightweight. What put us off using it: the lack of customization of user fields (first and last name mandatory) and the total absence of captcha support. For customizable fields, a ticket has been open</a> since 2023 and will no doubt be resolved by the time Zitadel V3 is released, but it’s always the same: you never know when it’s going to come out, it’s impossible to plan ahead, and in the meantime the functionality isn’t there. Criteria</th> Zitadel</th></tr></thead> Free / open-source</td> ✅ Apache 2.0</td></tr> Lightweight (RAM)</td> ✅</td></tr> Lightweight (image)</td> ✅ 130 MB</td></tr> Lightweight (CPU)</td> ✅</td></tr> OIDC support</td> ✅</td></tr> Backend other than LDAP</td> ✅ PostgreSQL</td></tr> bcrypt password support</td> ✅</td></tr> Login form</td> ✅</td></tr> Registration form</td> ✅</td></tr> Validation by mail</td> ✅</td></tr> Password recovery</td> ✅</td></tr> 2FA TOTP</td> ✅</td></tr> Open-source captcha</td> ❌ No captcha</a></td></tr> Localization (FR/EN)</td> ✅ Yes</a></td></tr> CSS customization</td> ✅</td></tr> RBAC (permissions)</td> ❓</td></tr> Integrated member area</td> ❓</td></tr> Simple to deploy</td> ✅</td></tr> Customizable fields</td> ❌ Not so much (1)</a>, (2)</a></td></tr> Active development</td> ✅</td></tr> Software reputation</td> ✅ 9k stars</td></tr> Language</td> ✅ Go</td></tr> </tbody></table> For the following softwares, we can’t provide you with a summary table because we haven’t tested them sufficiently, or it’s been too long since we tested them. 🔗</a>Canaille</h3> Canaille</a> is a small software program developed by a member of the CHATONS collective</a>, Yaal Coop</a> (the CHATONS member in question being Nubla, developed by this cooperative). Canaille is written in Python and uses a LDAP backend, but it seems to have recently integrated support for a SQL backend</a>. Initially, the software didn’t integrate a registration form, and this was a sticking point for us. So Denise tried to directly contribute to the code</a> to add this functionality, but the implementation wasn’t entirely satisfactory to the developers who first wanted to add other features that might depend on it. To avoid creating further inertia in our research, we moved on and tested other solutions. Today, Canaille seems to have integrated the registration form and could be a decent potential solution, but seems to be struggling to find its community and audience. 🔗</a>LemonLDAP</h3> We haven’t tested LemonLDAP</a>, but it’s a commonly suggested solution. It’s an OpenID Connect server that uses an integrated LDAP directory. It has many interesting features, including the account creation form and an open-source captcha. The software seems to have been created in 2006 and is maintained by French people. The fact that it’s written in Perl and works with LDAP was a bit of a turn-off, however. It wasn’t necessarily a deal-breaker, but the fact remains that we ended up testing other solutions because we had limited time and couldn’t test all the software; we didn’t linger on this one. 🔗</a>SSOwat</h3> SSOwat</a> is the authentication solution integrated into the Yunohost project</a>, which we examined very briefly and then quickly dismissed. It’s a Nginx extension written in Lua and uses an LDAP backend. As it happens, its operation is rather intrinsically linked to Yunohost, and it seems rather difficult to detach it from Yunohost - all the more so as we use Caddy</a>, and not Nginx, as reverse-proxy for our services. The software has changed quite a bit with the version 12</a> of Yunohost; the SSO module has been broken down into three separate modules, yet it doesn’t make it any easier to install in environments other than Yunohost itself. It remains a viable solution, provided that your infrastructure runs entirely under Yunohost. 🔗</a>Rauthy</h3> In the nice little projects category, we looked at Rauthy</a>, an SSO written in Rust. The software seems to have a number of features we needed, including the registration form. It depends on a PostgreSQL backend. It has the advantage of being extremely light and fast. For an SSO, it’s very sober and efficient. That said, the project is still far too young for our taste: maintained by a single person, not fully mature in terms of design and functionality, it’s still a bit of a wobbly solution, although it’s improving year on year. The software has no community (yet), so very little support and feedback too, and this inevitably works against it in the balance. 🔗</a>Hiboo</h3> Always keen on experimental projects, we took a look at the CHATONS TeDomum</a> project Hiboo</a>. We’re not the first to have thought of reinventing the wheel: TeDomum presents Hiboo in 2019</a> and tries to adapt unified authentication methods to their own taste. The project, written in Python, is experimental but generally functional according to TeDomum, which uses it in production. At the end of 2023, TeDomum’s developers took stock of this experimentation</a> and considered two options : to abandon the development of Hiboo and to prepare to migrate their database towards alternatives (Authelia, Keycloak, Authentik);</li> to give themselves the means to have a sustainable development model: have an active community, pay a dev…</li> </ol> Here ends our follow-up of the project, but it still seems to be alive and kicking. You can consult their repository</a> to find out more. 🔗</a>Finally… Keycloak</h3> Our research began with Keycloak, and ends with Keycloak. It was well worth it… It’s our fallback solution, which isn’t really that bad because it’s extremely widespread, which gives us a major advantage: if we run into a problem, we can be pretty sure that someone else has already run into it and that there’s a solution. Regarding RAM consumption: we’ve found, and corroborated with other testimonials, that although Keycloak consumes an irreducible minimum 500 MB of RAM, it doesn’t seem to go much further: </a> RAM consumption of our Keycloak over one week. It handles around 30 different connections per day. We manually restarted the service on November 20. </figcaption> </figure> With a limit of 1 GB RAM, the software should run smoothly and consume fairly little CPU on average. 1 GB is really a lot for us (a quarter of RAM for most of our machines…), but we eventually accepted this painful compromise. But that wasn’t the only sacrifice we had to accept. 🔗</a>A missing cog: the captcha</h4> We can’t yet deploy Keycloak as a replacement for our member area while we develop a captcha for Keycloak, a protection tool that we feel is absolutely essential to protect our service. Currently, Keycloak officially supports reCaptcha (Google), and the community has developed a plugin to support hCaptcha (Cloudflare). We’d like to add support for mCaptcha</a> (poorly maintained, but that’s our solution for now), which would require us to code a plugin in Java. Without this brick, we use Keycloak only for our digital support program, since they don’t include an account creation form. We’ll be able to use it to replace our member area once this brick has been written. 🔗</a>The vain multi-realm hope</h4> A “realm” is a Keycloak term for an environment in which an organization can create its own applications, have its own users, its own groups… Keycloak allows you to create several realms, which means you can host many different organizations, each with their own applications and users. This is useful for providing services to many different organizations. But the biggest advantage of this approach is also its biggest drawback: applications and users cannot be shared between several realms. For example, if a person is a member of the organization “The Beta”, but also of the organization “Maison des Peuples et de la Paix”, they will have to create two different accounts to access the services of these respective organizations. And if they become a member of La Contre-Voie, they’ll need a third account. What’s the point of having unified authentication if you have to create multiple accounts per person on it? But perhaps the most problematic issue is for applications: let’s imagine we wanted to make available a service shared by all organizations, for example a videoconferencing tool or a pad service… how should we proceed in this environment? The answer is simple: we’d need to deploy as many instances of this tool as there are existing realms, because almost all software that supports OpenID Connect can only connect to one OIDC server per instance. However, in this particular use case, this would be a huge waste of resources. We therefore decided - halfway down the road - to host everyone in a single realm. 🔗</a>Less autonomy for organizations</h4> Having everyone in the same realm imposes a serious constraint: management of members by third parties (e.g. administrators among the structures we host) is no longer possible. When each organization has its own realm, we have no problem giving Keycloak administration rights to managers within these organizations, as these rights are partitioned within their realm. A “referent” person could thus add, modify or delete members independently, and even give or withdraw access rights for services within their organization, without asking us. If everyone is in the same realm, giving administration rights to a referent means giving them rights over all the organizations we host, including our users, which is absolutely unthinkable. For the time being, the palliative solution we’ve chosen is to ask each organization to send us an e-mail with the list of members who are supposed to have access to their services, with their respective rights, each time this list is modified… then we transfer this list to production ourselves. We’re not going to tell you about the support work involved… Eventually (and fairly quickly), we’ll probably have to design a middleware that will act as an interface between the referent members of each organization and the Keycloak administration API, enabling them to manage their members and their rights in a controlled and restricted way. 🔗</a>No access rights management in Keycloak</h4> Incredible as it may seem, Keycloak doesn’t allow you to manage access rights to an application for certain users or groups. All members of a realm have access to all applications. Keycloak’s developers have decided that this is not part of the software’s scope, because Keycloak only handles authentication, not authorization (1)</a>, (2)</a>; that user authorization therefore falls within the application’s role. There is a plugin</a> for this purpose, but it can be easily bypassed in certain cases and is therefore not a secure solution at all. However, not all applications can restrict access according to user groups (e.g. a Nextcloud plugin</a> didn’t support this until… last week!), which adds a serious constraint to the selection of applications we offer. As a rather effective workaround, we use the Caddy plugin caddy-security</a>, which enables us to create an authentication wall on any application within the reverse-proxy, according to the groups/roles assigned to each user. 🔗</a>One last solution for the road…</h3> There is a perfectly valid solution to setup multiple services with OpenID Connect without too much headache: use one of the applications as an authentication provider. For example, if you are serving Nextcloud, Nextcloud itself can act as an OIDC identity server. The same applies to most well-known applications, such as WordPress. This means that members will use their logins for these applications to connect to other applications. However, this implies that your members must have an account on the application acting as provider (e.g. Nextcloud or WordPress); this may not always be desirable. Also, compliance with any other criteria you may have (captcha, group management, organization management, field customization…) can prove rather complicated. 🔗</a>Conclusion</h3> In short: we’ve adopted Keycloak, even if we’re not very happy with it due to missing functionalities and rather restrictive use cases. But don’t bother suggesting other SSO solutions! Now that we’re on Keycloak, we don’t intend to change just yet, as it’s a very cumbersome and time-consuming operation and we’ve already spent a good two years looking for the ideal solution without finding it. However, we hope this article will give you a clearer idea of the range of possibilities and make your choice easier! Bear in mind, however, that some of the software we have presented has evolved significantly since we first reviewed it. For ethical digital service providers, we see unified authentication as a major challenge, for a number of reasons: The search for convenience. For an uninitiated public, used to the “all-in-one account” from Google, Apple or Microsoft, unified authentication for free services is not disorienting, and offers a level of comfort that will make it much easier to get used to, especially if you offer several different software packages. Services open without registration are increasingly difficult to maintain. Services like Framaforms</a> are overflowing with spam, shared pads are being used for phishing purposes, even our link shortener</a> is costing us moderation time</a> every week. By the end of 2023, many Jitsi (video conferencing tool) instances had to close</a> due to a surge in unlawful and unethical usage. We hope this lengthy summary of our research will be useful to some of our readers! If you think this kind of feedback is valuable, you can support us financially to enable us to continue documenting our work</a>: </div> </div> Drop your star</h3> and donate to La Contre-Voie !</h4> </div> </a> Diving into the technical infrastructure of La Contre-Voie neil — Tue, 03 Dec 2024 10:45:00 +0200 In this article, we take you behind the scenes to discover the hardware we use to bring you our new digital services. This special article will therefore be written in technical jargon incomprehensible to the average person… but you can find our other articles on our digital support program</a> or our new service offering</a> if that’s not the kind of content you’re interested in. At the launch of our roadmap</a>, we pledged to develop our digital autonomy with small-scale self-hosted servers, and to launch our digital support program - which implies to widen our technical arsenal. Over the course of 2024, we’ve been installing our first self-hosted servers and configuring our first services on them. Initially, this article was intended to present our servers, our SSO and the software we use, but as the article became far too long, we decided to split it into three. This first article will therefore deal with the self-hosting of our servers. At the end of 2023, we only had three… but today, our infrastructure is made up of eight servers distributed as follows: </a> Our eight production servers. </figcaption> </figure> All these servers communicate via a private WireGuard network, with the exception of sarus, our supervision machine. 🔗</a>Virtual servers</h3> We have four small VPSs at PulseHeberg</a>: balearica and antigone are our historical servers, commissioned in 2022; balearica (8 GB RAM, 50 GB SSD) hosts a large part of our services and antigone (2 GB RAM, 250 GB HDD) serves as a storage machine.</li> griza, commissioned in early 2024, hosts our mail service, and stanley is a new server hosting a secondary mail service. Both have 2 GB RAM and 250 GB HDD, like antigone.</li> Initially, all mail was hosted on balearica, but we decided to dedicate an entire VPS to mail for reasons of storage space and stability.</li> </ul> Then, we also have a virtual server graciously donated by the association Picasoft</a> since 2022 (if you’re reading this, thank you!), named sarus, which serves as our internal and external supervision machine. As these are VPS servers, we don’t have much to say about their physical hosting conditions. The rest of this section will therefore focus on the servers we host ourselves. 🔗</a>Self-hosted servers</h3> Finally, we can tell you about our little selfhosting project. The Bêta, a non-profit community center in Angoulême that we introduced in our previous article</a>, has been hosting two of our servers since early 2024: pavonina, an Odroid microcomputer (model H3</a>), 64-bit architecture, 64 GB RAM and 2 TB SSD storage, hosts all our à la carte services (including four Nextclouds) without a hitch, and consumes an average of ten watts.</li> monacha, an old recovery laptop with 4 GB RAM and 128 GB SSD, serves as our CI/CD and test machine. It consumes an average of 15 watts.</li> </ul> And just a few weeks ago, the Maison des Peuples et de la Paix (MPP), a second Angouleme-based community center and our head office, has been hosting a server: demoiselle, another Odroid microcomputer (model HC4</a>), ARM architecture, 4 GB RAM and 128 GB SSD, 8 watts average power consumption, will soon serve as our storage machine.</li> </ul> We are fortunate to have received a generous donation of 12b from the Distrilab</a> at the end of 2023, of the two Odroid computers that now serve to run the next generation of our infrastructure, through our two servers pavonina and demoiselle. (12b, if you’re reading this, please know that without your contribution, it would have taken us another year. Thanks to you!) </a> Left: pavonina, out of its metal case. Right: demoiselle, the “toaster” that serves as our server. </figcaption> </figure> 🔗</a>Other hardware features</h3> The network: The Beta is equipped with a Freebox (with optical fiber) which was already there before we arrived, and to which our machines are connected. The MPP, on the other hand, is equipped with the Aquilenet fiber</a>. Electricity: we have purchased UPSs to power our servers and the Internet network in the event of breakdowns or micro-cuts. These are simple domestic UPS from Eaton, model 3S, with a capacity of 550 VA, controllable via USB. </a> Real-time statistics on the power consumption of our servers at Beta. 63 watts on average, allow for 10 W (pavonina) + 15 W (monacha) + the Freebox (~40 W). </figcaption> </figure> Fire safety: we’ve had to deal with concerns from our hosts about the risk of our machines or batteries catching fire… Given the electricity consumed (less than 200 watts, and less than 50 watts per device), this low-voltage equipment isn’t much more dangerous than a battery-powered clock radio, but it’s so easy to take a few extra precautions that we’ve taken the initiative to address these concerns : by investing in two smoke detectors, one for the Beta and one for the MPP, neatly placed next to the batteries;</li> by purchasing a USB thermometer (Elitech brand) to measure room temperature in real time (we still have to connect it to our supervision tool…).</li> </ul> 🔗</a>Security of the premises</h3> The community centers that hosts us often have lots of public; sometimes more than a hundred people during lively evenings. It goes without saying that we can’t just set up a server in a busy place, and that electrical outlets and the Internet must never be accessible to the public. To secure our installation, we have established criteria based on SecNumCloud</a> (page 28, chapter 11), which defines three types of zones: public zones, which are those accessible by anyone;</li> private areas, which may correspond to the establishment’s administrative offices, where the public may not enter unaccompanied;</li> sensitive areas, which are intended to house servers and must not be in direct contact with a public area.</li> </ul> Well, that’s a very rough summary, as the standard is very wordy and demanding. We obviously don’t have the means to comply with it in its entirety, but it’s a useful resource for establishing the basic criteria for a secure infrastructure. For example, we haven’t yet installed a biometric identification system for access to our servers, and it’s not going to happen any time soon… Thus, at both the Beta and the MPP, our servers are located in a locked cabinet accessible only from a private area (administrative offices to which the public is forbidden access). The Internet box and UPS are both stored in the cabinet with the servers. In short: we do our best, we take hardware security seriously with the small means we have, even if it’s not quite up to the highest standards of datacenter server hosting. </a> Our cabinet at the Beta with our pavonina server. Since the photo was taken, the UPS has been replaced and monacha has been installed. </figcaption> </figure> 🔗</a>Security of hosted data</h3> Even if we take great care to secure physical access to our servers, what happens in the event of a successful intrusion by a malicious person (or worse, a search warrant)? We have a simple remedy, albeit a rather uncommon one on servers: full disk encryption. So we installed an SSH server in the boot partition of our machines, enabling us to decrypt the server remotely. The only drawback: if the server reboots for any reason (power failure, freeze…), human intervention (remotely) is required to decrypt disks and start services. For x86 machines, we followed the TeDomum tutorial</a>; for our ARM machine running on Armbian, we roughly followed this tutorial</a>. In this way, if someone manages to get into our host’s private offices, open the locked cabinet and retrieve our hard disks, they won’t be able to do anything with them without knowing the decryption password. In the case of a search, this will require the police to obtain the agreement of a judge and to call on our technical team. </a> A network box used as our server cabinet at the MPP. It’s not yet fixed to the wall because of the work going on in the community center, but it’s coming soon. We’ll improve the wiring then… </figcaption> </figure> 🔗</a>Contractual commitments</h3> And finally, as an essential last step in our partnership with these two third places, we have mutually signed a hosting agreement. This agreement, drawn up by us, formalizes the mutual commitments on our part, and on the part of the structures hosting us. In broad terms, here are the commitments of the Beta and the MPP: Lend us a small, enclosed space with electricity and Internet access;</li> Do not disconnect the machines without good reason (emergency, force majeure, risk of any kind to people or property, etc.);</li> Do not intervene on machines or hard disks without our authorization;</li> Allow us to intervene occasionally for maintenance purposes or in the event of machine breakdown;</li> Allow us access to the Internet box parameters for configuration and supervision purposes;</li> Ensure the security of the premises;</li> In the event of termination of the agreement, to give us two weeks to move the premises, except in cases of force majeure.</li> </ol> And here are our commitments: To setup our experimental digital support program</a> with the Beta and the MPP in its entirety;</li> To provide these structures with a level of service corresponding to their technical needs (disk space, machine capacity, etc.), within reasonable limits and in proportion to the provided hosting service ;</li> To not exceed 200 W of electricity consumption, not including the Internet box;</li> To assume on behalf of the Beta and the MPP any legal responsibility that may be imputed to them concerning hosted data, with the exception of data put online by these structures themselves;</li> To take care of the premises.</li> </ol> As you will have understood, this agreement is a non-pecuniary exchange of good practices, which has enabled us to beta-test our digital support program and to host our servers free of charge. We don’t pay for electricity or premises, we can intervene on our servers at any time if need be, and in exchange, we support the Beta and the MPP at our expense and maintain their digital services for free. 🔗</a>Future enhancements</h3> For the time being, we’re considering several developments for our servers, to come by next year or later, depending on our priorities. Increasing our storage capacity. We’ve been using low-capacity SSDs to start with, but if we need to store more data, we’ll need to increase the capacity of these drives. We’d also like to create data redundancy at hard disk level (with RAID 10, for example), in addition to the redundancy and backups we already perform at software level. Shutdown some VPSes. Now that we have our self-hosted servers, we’ll be able to transfer certain services to these servers. In particular, we plan to terminate the hosting of balearica and antigone, renting a smaller VPS server to host the services we don’t want to transfer (mail, link shortener, etc.). This should also reduce our technical costs. Host new servers. We’re going to add at least one more server to handle encoding for PeerTube videos, and then we’ll take it from there. It’s conceivable that we’ll separate the computing and storage servers to make maintenance easier, and invest in decent storage servers for our needs (a microcomputer might do the trick). But before that, we’ll need to consolidate our infrastructure, including software and supervision (temperature, consumption measurements, alerts…). And we’re done introducing our hardware! In the next article, we’ll talk about our unified authentication solution, or SSO. And don’t forget: our actions depend directly on your support. If you appreciate this feedback, would like to see our association exist in the future, and have the means to do so, you can make a donation! See you soon! </div> </div> Drop your star</h3> and donate to La Contre-Voie !</h4> </div> </a> Digital support: our modus operandi neil — Tue, 26 Nov 2024 10:45:00 +0200 In addition with our new service offer</a> currently under development, we also provide digital support services primarily for associations. Today, we present a first feedback on a digital support program completed during the year. 🔗</a>Digital services and support</h3> Among all the little new things we’re announcing, it might be useful to put the right words to clearly define our projects. So, what’s the difference between the à la carte services we presented last week</a>, and the digital support program featured in our roadmap</a>? It’s very simple: à la carte services are just software installed on demand, like a WordPress site or a Nextcloud instance. These services are provided as is, with no training or data migration assistance, and only our technical support to help out when needed. It’s the perfect option for a geek who wants to host a static site and is just waiting for us to give him the key to an S3 bucket, or a resourceful association that needs a Nextcloud, provided that the people in the association : knows exactly what they are doing ;</li> knows exactly what its technical needs are, and doesn’t need help diagnosing them;</li> doesn’t need any training for their members, or can train them on their own.</li> </ul> But in most cases, and particularly for non-tech associations, installing open-source software is all very well, but it’s not enough: without training, the transition to open-source tools is difficult, and the tools are sometimes used the wrong way and not to their full potential… Especially as associations don’t always know in advance which open-source tools could help them, and sometimes need help to get started. That’s why we offer digital support: we provide tailored help in migrating to open-source tools, by taking stock of what already exists. To meet identified needs, we offer “à la carte” services, and also suggest other ethical hosting providers</a> if we can’t meet certain needs with our service offering. Digital support also includes training if required, and long-term follow-up. “À la carte” services are therefore a component of our digital support, but cannot stand alone in most cases. 🔗</a>Targeted audience</h3> We aim to provide this service first and foremost to associations / non-profits, whether they have employees or not. That said, these services are aimed at everyone: communities seeking to leave Microsoft by all means ;</li> geeks who are technically adept and wish to entrust us with the hosting of their services;</li> micro-entrepreneurs who want to host a website;</li> small local businesses…</li> </ul> As for our solidarity rates, we also want to give priority to associations, but without discriminating against other categories: as micro-enterprises are often quite precarious, we don’t rule out offering them solidarity rates, even if their structure is essentially for-profit. On the other hand, a local city is not a for-profit organization, but even so, we are aware of their financial resources (and their budgets allocated to tools from Google, Microsoft et al.), and we know that they are not a category that can be described as “precarious”; so we don’t plan to offer them solidarity rates. 🔗</a>Our modus operandi</h3> Here’s a diagram showing how we work with each structure that contacts us. You’ll find details of each of these steps below; click on the step you’re interested in to find out more. Step 1</a> : Making contact</li> Step 2</a> : Diagnosis of digital practices</li> Step 3</a> : Drawing up specifications and estimates</li> Step 4</a>: Installation of “à la carte” services</li> Step 5</a> : Member training course and data migration</li> Step 6</a>: Follow-up and support</li> </ul> Someone technically literate who does not need any of the administrative stuff and only willing to have a website will be skipping a number of steps to limit themselves to contact, service installation and support. On the other hand, for an association which is not at ease with tech stuff, we’ll probably go through all the steps and spend more time on training, face-to-face where possible, sometimes with several sessions. </div> Our case study: the Beta</a></h3> The Beta is a community center for artistic and cultural expression maintained by the Saxifraga association since 2019, located in Angoulême (France). After having carried out several interventions there in 2023, we are accompanying the Beta towards its migation out of Google by beta-testing our digital accompaniment. The Beta will be our case study throughout this article. </div> </div> </div> 🔗</a>Step 1: Making contact</h3> It usually begins with an e-mail to our contact address</a>, from someone interested in ethical tools for their association or personal needs. This essential step serves several purposes. Assessing the level of technical knowledge: from our discussions, we quickly realize whether the person in front of us seems technically at ease, or whether they will need assistance (which we will offer in all cases). Assess the need for a diagnostic: does the structure or person have a clear idea of what they’re looking for? Is a diagnosis of digital practices (step 2) necessary? In general, this is something that can be deduced from the formulated request: “I want a Nextcloud” is very different from “I’m looking for a way out of Google tools”. Clarify that our services have a cost: we can’t yet discuss concrete amounts without knowing exactly what services the structure needs, but we do make it clear fairly quickly that we charge for hosting services, to avoid any illusions on the part of the structure. Our audience sometimes confuses “free software” (as in costless) and “free software” (as in freedom), or is accustomed to the costless nature of other well-known free software services such as Framapad</a>. </div> Getting in touch with the Beta</h3> The Beta has quickly become a privileged partner for us since our arrival in Angoulême</a> two years ago. In 2023, we held a cycle of four activities throughout the year to raise awareness of digital ethics. It was a subject that already interested the Beta. </div> </div> </div> So in 2024, when we set out to launch our digital support program, we thought the Beta could serve as an experiment for our first digital support. We told them about it, warning them that it would take a long time to get technically ready, and they liked the idea - they were in no hurry. That’s how the support began. One of the triggers for this support was the increase in price of Wix, their web host and site engine, which went from €200 per year to €310 per year to host a site of a few pages. 🔗</a>Step 2: Diagnosis of digital practices</h3> The diagnosis serves to identify the structure’s needs, when it doesn’t know exactly what digital tools could help it. It allows us to take stock of the tools currently in use (sometimes scattered across a number of platforms), to define the structure’s expectations of our intervention, and to identify potential new tools it might need. After several email exchanges and sometimes a video or face-to-face meeting, we determine whether the structure needs a diagnosis or not (in general, individuals don’t need a diagnosis). If they do, we ask them to fill in our diagnosis of digital practices</a>, a short form that enables us to get a better idea of the structure we’re dealing with. The diagnosis can be carried out by anticipation during the initial contact, and ideally in visio or face-to-face to ensure that the person interprets correctly the questions asked, particularly in terms of tools. Some common mistakes: confusing the role of a newsletter with that of a mailing list;</li> confusing the e-mail provider (Gmail) with the tool used to consult them (Thunderbird);</li> confusing the website engine with its host…</li> </ul> Once the diagnosis has been completed, it’s up to us to study it internally and come back to the structure with a proposal for specifications. </a> The diagnosis filled in by the Beta in September 2023. </figcaption> </figure> The Beta was using a bunch of tools on many different sites: Framapads, Framacalcs, Wix, a Google Drive, Gmail, Discord… The structure was simply trying to do the best it could with the existing technical means and their knowledge. 🔗</a>Step 3: Specifications and quotation</h3> The specification is a document that formalizes the scope of our intervention and specifies its outlines. It contains proposals for software or services based on the needs formulated in the diagnosis. The proposals we formulate are used directly to draw up our quotation. 🔗</a>Suggesting open-source software</h4> This is the simplest and most satisfying stage for any librist who knows their alternatives by heart… </a> … Or not. It depends on how far along you are to decide. </figcaption> </figure> Beyond the purely technical questions of which software to use, we have to face up to the harsh reality of things: sometimes, even if a structure puts its good will into making the transition to open-source tools, it may still want to comfortably accomplish its associative purpose rather than spend most of its members’ time fighting with open-source services that don’t work well or that don’t help them to pursue their goals (unfortunately, not all open-source software is emancipatory). And so, we sometimes have to compromise on our librist ideals to provide the best possible support. If you’re going to provide digital support, you’ll have to face this dilemma: are you here to evangelize FOSS and suggest (or even impose) that the organization use as much FOSS as possible, completely banning proprietary tools, even if it means giving them inadequate or impratical tools?</li> or are you there to help the organization achieve its purpose as efficiently as possible with digital tools, whatever they may be?</li> </ul> As far as we’re concerned, in a good number of cases, we recommend open-source software because we feel that our beneficiaries have everything to gain in terms of efficiency, ease of use, issues around the protection of their own data… But there are situations in which we can’t propose an open-source alternative, because it would be counter-productive for the structure to change their tools (too much training time, too many difficulties to take the step, too much time wasted for few results), or when there is no open-source tool really adapted to their needs. In such cases, we suggest staying with a proprietary tool, much to our regret, so that using an unsuitable open-source alternative doesn’t become a handicap for the structure. 🔗</a>Our recommendations</h5> Here you’ll find, in no particular order, the “compromises” we’ve reached in recommending free solutions. These are biases, and they might make your hair stand on end, but you have the right to disagree, and we have the right to disagree with you too. La Contre-Voie is preparing its new services offer for you neil — Tue, 19 Nov 2024 17:45:00 +0100 This is the first in a series of articles about La Contre-Voie’s 2024 fundraising campaign. In this article, we will introduce you our future digital service offering. Over the past few years, we’ve been constantly receiving requests to set up digital services that meet very common needs for collectives: from website hosting to a Nextcloud in order to manage files shared across an organization (not just a personal account</a>), to a newsletter service… Until now, we could only redirect these collectives to other ethical hosts</a>, as we were unable to meet this demand. But very soon, this is going to change: since the beginning of 2024, we’ve been preparing a new range of services to equip associations and individuals! We are currently testing these services in real-life conditions with local associations, and we hope to officially open most of these services to the public during 2025, if you give us the means. In the meantime… here’s the list! 🔗</a>“A la carte” services</h2> The following services will be subject to pricing (more on this below). They have all been under experiment with associations for several months. </div> WordPress or static site</h3> We can host a website created with WordPress, the world’s most widely used website creation software, or as a “static” site (S3 bucket) by uploading the raw website files. For the time being, we don’t plan to help with the design of the website: we only take care of the hosting. </div> </div> </div> </div> Nextcloud Suite</h3> The complete alternative to Google Suite, with tools for creating forms, surveys, calendars and shared files, and a collaborative Office document editor. Unlike our current Nextcloud service</a>, each structure will be able to create an account for each member of their organization. </div> </div> </div> </div> Accounting</h3> With the Paheko</a> software, which we’ve been using for our own accounting since 2019, you can keep the accounts of an association or a micro-business without fearing for your personal data, and in an interface that (really) makes you want to do the accounting. </div> </div> </div> </div> Newsletter</h3> To send out mass newsletters, from 20 to over 500 people, we set up a dedicated service, with optional tools to track subscriber engagement. We offer Listmonk</a> or possibly Paheko</a> for this purpose. </div> </div> </div> </div> Videos</h3> To host your videos, we suggest PeerTube</a> as an ethical alternative to YouTube. The application can also be used to broadcast live video. The platform we set up will be shared by all our beneficiaries. </div> </div> </div> 🔗</a>Membership services</h2> Our three historic member-only services (Mail</a>, Git</a> and Nextcloud</a>) won’t be changing much, but will rather receive improvements over time. </div> Mail V2</h3> A mailbox hosted with us, rather than with Gmail: our mail service</a> is growing and improving, with a new webmail</a> now available. We now have about fifty domain names registered on our service, 360 mailboxes and almost 1600 redirects. </div> </div> </div> Because we want to democratize the use of ethical e-mail as much as possible, this service will always be included in the membership, including the personalized domain name. 🔗</a>Services for registered users</h2> We’re also working on new services that will require a registration (by creating a free account on our platform). We haven’t yet decided which software and services we’ll host, but we’re considering the following tools: Videoconferencing ;</li> Instant messaging ;</li> Password manager ;</li> Shared pads…</li> </ul> Implementation of these services in 2025 is less guaranteed than à la carte services, as they meet lower-priority needs and we still have a few technical prerequisites to overcome. 🔗</a>A new applications portal</h2> Among the new features we’re working on, we’re designing an applications portal to replace our current members’ area. This portal will bring together all applications, with or without registration, those intended for our members and the “à la carte” services to which the user has access. You can find the portal code here</a>! </a> The future applications portal (work in progress!). </figcaption> </figure> 🔗</a>One account for all applications</h2> Our biggest technical project, once completed, should improve your ease of use: you’ll now have just one account to access all the applications we offer. This little magic trick is made possible by the SSO software Keycloak</a>, and should make it much easier to navigate from one application to another. All you’ll have to remember is a single login and password! For our part, this represents a huge amount of work to migrate existing data, currently locked away on a small piece of software written by ourselves in 2019. We’ll report on our technical adventures in a future article. 🔗</a>When will it be available?</h3> For “à la carte” services: we hope to officially open all these services during 2025, if we can overcome the technical challenges that this service offering poses for us, and if you give us the financial means</a>. For the services for registered users: this will depend on how much time we have! They could arrive in 2025, but it’s not out of the question to wait until 2026. This new service offering has nothing to do with the tools we currently maintain, which is why we need a full-time employee to take care of it: on the one hand, to reassure our beneficiary structures that they can always have a human face to respond quickly to support requests (chatbots and AI are not our style!)</li> on the other hand, to take care of the technical maintenance work that this service offering entails, to keep the software up to date and make sure everything’s running smoothly.</li> </ul> So, if we don’t raise enough money to pay someone full-time to deal with these issues, it’s possible that the release of these services will be postponed, because we can’t afford to launch new services without making sure we’re in a position to maintain them. 🔗</a>At what price(s) and under what conditions?</h3> We’re under no illusions: we’re a small association, and we don’t have the reputation or resources of Framasoft</a>, so we don’t expect to gather enough donations to cover a full-time minimum wage for one person to maintain the entire offering - barring an exceptional sponsor, that would be nice, but we’re not particularly counting on that!… For example, we cannot offer a service equivalent to Frama.space</a> without financial compensation, as the technical costs and maintenance time involved would be too high for La Contre-Voie to bear. So we’re going to diversify our sources of income by offering services “à la carte” on condition of an annual financial contribution to cover part of the costs, at a reasonable price. For example: For 5 GB of space for a static website or WordPress: 60 euros per year, or 5 euros per month;</li> For 20 GB of space on a Nextcloud service entirely dedicated to organization: 120 euros per year, or 10 euros per month.</li> </ul> These rates are in addition to the annual fee</a> (for a collective: 30 euros per year) and are adapted to the storage level chosen. The other rates have not yet been fully established, as we still need a little time. We have, however, agreed special conditions of use for this “à la carte” service, which you can find here</a>. Registration-based services (that does not need an annual subscription) will be entirely free to use, financed by your donations and our other sources of income. 🔗</a>Are you playing the capitalist game?!</h3> Making a decent living and offering affordable rates is a complex equation, isn’t it? Fortunately, we have a solution that should suit small associations that don’t have the means to pay for these services: the introduction of solidarity rates to adapt to the means of structures in need, and relying on donations to cover this reduction in rates; because if we offer a reduction, the price difference falls on our shoulders and has to be financed by other means. In this way, we hope to cover our financial needs without causing harm to small associations who might need our tools. We’ll have more to say about our pricing policy in a later article. Thank you for reading, and see you next week for a new article! </div> </div> Drop your star</h3> and donate to La Contre-Voie !</h4> </div> </a> CHATONS 2024 camp report alex — Sat, 31 Aug 2024 10:45:00 +0200 Today we’re bringing you a blog post in a slightly different format. This is a report from alex, our secretary, on the CHATONS 2024 camp. </blockquote> Last month, from Thursday July 11 to Monday July 15 2024, the CHATONS</a> camp was held at l’Antenne</a>, a former holiday centre that has been converted into a collective home for the past 2 years, in Sévérac in the Ile-et-Vilaine region, France. The CHATONS collective brings together around a hundred organisations from all over the French-speaking world, with the common aim of providing alternative digital services to the web giants. As a service host, La Contre-Voie has been a member of this collective for over 5 years. The CHATONS camp is an annual event for anyone with an interest in the collective. This year was the fourth edition, and my first participation. Here’s a brief report on the event and the workshops I attended and took part in. The camp is organised in an open forum</a> format, with the workshop programme decided during a plenary session in the morning. On Friday morning, I took part in a workshop entitled “How to reach a non-librarian audience”. After a round table discussion, we summarised our positions and ideas in a number of points. I think it’s necessary to maintain a public presence (i.e. to talk about and promote this alternative outside our own spaces of conviction), to raise awareness and to help groups migrate towards alternative services, rather than focusing primarily on individuals. (As an aside, that sounds a lot like what we’re trying to do</a> at La Contre-Voie!) In the afternoon, a workshop was organised around the 18th litter (fr)</a> applications. Since we at La Contre-Voie had not yet made up our minds, I took the opportunity to take part in this collective review of the applications and then vote on behalf of the association (fr)</a>. On Saturday morning, members of the steering committee of the working group (fr)</a> “De-Gmail-ization campaign” proposed a workshop to share their roadmap. The aim of this working group is to try to get people to migrate away from Gmail, based on the various email services offered by the CHATONS. Their starting point is the observation made by some of the organisations in the collective that many of their members/subscribers contact them using Gmail, Outlook, Orange, etc. email addresses. The strategy would therefore be to launch a communication campaign within 6 months to 1 year to support the migration to more free/ethical hosting. The working group is supported by someone specialised in communications.We were asked the following questions in advance of this workshop: What would make users switch away from Gmail?</li> What would be the obstacles or facilitators to this switch?</li> What alternative email providers do you know of?</li> </ul> Following a round table discussion on the reasons for our presence at this workshop, we gave a quick round-up of the answers to the questions posed (in the form of large sheets of paper on which everyone was free to write). On a personal level, and echoing the idea of being present and communicating about free software, I find the idea of such an awareness-raising campaign relevant. Without committing the association, I’m thinking that La Contre-Voie could act as a relay when the campaign takes place (and why not suggest awareness-raising elements such as visuals and text in advance of the campaign). In the afternoon I took part in the workshop entitled “How to infuse a culture of cooperation into our communities”. I went more as an observer than as someone who had something to share. We talked about tout-doux-cracy (fr)</a>, a priori trust, an election process without candidates. I left the workshop prematurely to join the one on “Algorithmic Video Surveillance (AVS) - Dangers and counter-attack”, which looked at how AVS (fr)</a> has made its way into the public arena and how the Olympics have helped to establish its presence even further. La Quadrature du Net offers tools to identify and challenge the deployment of the AVS. I then attended the presentation of the reaction</a> tool, which is an alternative to fail2ban (an IP address blocking tool). I really liked the project, which follows the UNIX philosophy of doing one thing and doing it well. Reaction lets you define rules (based on reading log files) and actions that are carried out when the rule is applied (e.g. ban IP addresses, send an email, etc.). The tool is intended to be more accessible and lighter than fail2ban. The software’s roadmap provides for the possibility of sharing information between several servers, which corresponds to our use case at La Contre-Voie and could enable us to move away from our in-house hack with fail2ban in client/server mode via a file on an NFS disk. In the evening we were treated to an open stage of talent and non-talent sharing. It was a lot of fun :). Sunday morning was all about email for me. It started with a workshop on an educational tool (fr)</a> to demonstrate the benefits of SPF, DKIM and DMARC (authentication methods for email). I’d seen the tool presented at JCSA 2023 (fr)</a>, which made me want to try it out and why not make it my own. Unfortunately, the 4G network didn’t allow me to test the tool during the workshop. It’s only a postponement ;). Afterwards we talked about mutualising emailing. The remaining idea from the workshop is to set up a working group to propose/develop an intermediary tool between CHATONS and email hosts such as Gmail or Orange. This software would help to determine whether a CHATONS is at risk of having its emails refused. The idea is therefore to prevent (and guard against) problems with the undeliverability of email before this actually happens and be able to anticipate any risk of blocking by the big email operators sufficiently in advance (a sort of email firewall). To conclude, I attended the presentation of the new features of Paheko (fr)</a> (the association management software we use at La Contre-Voie for our accounting). Although I’d never used the software before, I was curious to find out more (and I quickly tested it afterwards via a demo instance</a> provided by Paheko). There are quite a few new features, such as modules, document management and synchronisation and editing with Collabora… It was noticed that it’s starting to look a lot like what Nextcloud offers. This clarified a point about data partitioning: in Paheko data is partitioned by association, whereas with Nextcloud it’s partitioned by user account. In conclusion, I had a really good camp. Thank you to the people who organised and ran it. For the record, this was the first self-managed camp, unlike previous camps which benefited from the involvement of the person in charge of coordinating the CHATONS. I was able to meet a lot of people whose voices I’d sometimes already heard at the monthly CHATONS meetings or even met at la constituante (fr)</a> last October. All in all, I have to say that it feels really good to be surrounded by people who share the same values and political sensibilities for a few days. See you next year! alex Our donations for other structures in 2023 Unknown — Mon, 25 Dec 2023 18:00:00 +0100 Like every year, La Contre-Voie makes financial contributions to other organizations. This article features those we have chosen to support in 2023. Find out more about the structures we have supported in previous years: 2021</a>, 2022</a>. We usually devote 15-20% of our budget surplus to donations to organizations we wish to support. This year, our budget for this purpose in January 2023 is 260 euros. 🔗</a>La Contre-Voie supports Wiquaya and Deuxfleurs</h3> After consultation, and following a call for proposals sent out through our internal channels, the Contribution Committee</a> has decided to distribute this budget as follows: 100 € to Deuxfleurs</a>, a CHATONS</a> that hosts services and develops software such as garage</a>;</li> 160 € to Wiquaya</a>, an association raising awareness of Internet privacy for queer/lgbti+ people.</li> </ul> We hope that this gesture, though symbolic, will enable you to discover these associations, or even contribute to them in your turn. 🔗</a>On budget allocation</h3> Until now, we had chosen to allocate 15-20% of our surplus to donations to other structures. With the increase in our budget linked to our new roadmap</a>, we will be reviewing this method of calculation for subsequent years, taking inspiration from initiatives such as Copie Publique</a>. We are also considering shifting our accounting year to run from September to August rather than from January to December, for practical reasons linked to the organization of our donation campaigns. Our next financial year will therefore be shorter than usual (January to August) to make this transition. For this reason, there will be no budget allocated to donations to other structures for this financial year, as we still plan to give once a year and at the end of the year. 🔗</a>About our donation campaign</h3> We launched our donation campaign</a> at the beginning of December and managed to reach half of our target, as of December 25! Thank you all for your contributions, which enable us to cover the costs of our services and help us prepare our new projects</a>. We would especially like to thank the associations Kidideux</a> and Framasoft</a> for their generous donations of €5,000 and €500 respectively, as well as the cooperative Scopyleft</a> for its donation of €1,000! These organizations are now listed on our Our Patrons</a> page. You still have a few days before the end of 2023 to drop your star on our participative constellation</a>! If you’d like to give us the means to carry out our activities, you can make a donation. Alex & Neil </div> </div> Drop your star</h3> and donate to La Contre-Voie !</h4> </div> </a> Launch of our 2024-2026 roadmap Unknown — Sat, 02 Dec 2023 19:00:00 +0100 After (almost) five years of existence, we are writing our first roadmap</a> to formalize the direction we wish to take over the next three years. This structuring step will enable us to clarify our approach to our public, but also to enable our funders to know more precisely our intentions and how their financial support will be used. For these three years, from 2024 to 2026, we will focus on four projects: Launch a support program</a> to guide associations and collectives towards better use of digital tools ;</li> Develop our own digital autonomy</a> by hosting our own (small) servers to regain control over our infrastructure;</li> Train our audiences in digital ethics</a> by carrying out local educational interventions and developing new educational content;</li> Strengthen our associative links</a> by actively contributing to the CHATONS collective and forging links with other associative structures.</li> </ul> Click here to view the full roadmap.</a> We hope you’ll be inspired by our little contribution to digital freedoms. 🔗</a>With what means?</h3> For the first time since the creation of La Contre-Voie, we’re going to try to remunerate the people who work for the association. To reach this milestone, we need to multiply our budget: as a reminder, in 2022, our annual budget was 2,300 euros. In 2023, we have doubled it to 4,800 euros. A part-time minimum wage currently costs around 16,000 euros, and 21,000 euros full-time… There’s still a long way to go, and we’re going to take things one step at a time. This evolution means that we need to build up reserve funds so as not to put La Contre-Voie in a dangerous financial situation in the event of a bad accounting year. To get off to a risk-free start, we won’t be setting an annual budget higher than our own funds: which means that if we want to set ourselves an annual budget of 10,000 euros, we’ll first have to make sure we have the same amount in reserve. For the first year of this roadmap, we will therefore need 15,000 euros: our annual budget will be 10,000 euros, and we hope to build up 5,000 euros in reserve funds. Details of these expenses can be found in the relevant section of our roadmap</a>. 🔗</a>Who gives us these resources?</h3> We’re looking at a number of different sources of funding, but it’s clear that we hope to obtain the majority of our financing from you, through your donations. We are therefore officially launching our donation campaign: until the end of 2023, you can drop your star</a> on our participative constellation to financially support our projects. </a> Other sources of funding for our projects include: Subsidies: we haven’t applied for any so far, but we plan to look into regional subsidies in the coming years to help increase our budget;</li> Awareness-raising events: we’ll continue to price our events</a>, always depending on the means of the structures that invite us;</li> Digital support for structures: if we manage to develop our support program</a>, we hope that the associations and other structures that will benefit will contribute financially according to their means;</li> Membership fees and hosting services: if we succeed in self-hosting our infrastructure</a>, then increasing its capacity and resilience, we could consider hosting new services;</li> The sale of T-shirts, although the funds generated by this activity do not allow us to pay a salaried position.</li> </ul> We’re counting on your support to make these projects a reality! Discover our complete roadmap here.</a> </div> </div> Drop your star</h3> and donate to La Contre-Voie !</h4> </div> </a> Introducing our new documentation Unknown — Thu, 28 Sep 2023 18:00:00 +0100 The lack of activity on our blog this year would suggest that we haven’t devoted much time to writing. In reality, it’s a long-term writing project that we’re in the process of completing on our French documentation</a>. This represents a total of 50,000 words, the equivalent of : 50 tribunes de La Quadrature du Net to defend the right to encryption</a> (which we signed</a>) ;</li> 22 CHATONS Charters, for which Neil launched a revision process</a> this summer;</li> 15 speeches by Emmanuel Macron on Covid-19[^1] ;</li> 10 Facebook terms and conditions;</li> 2.5 times the entirety of our moral and financial reports</a> written since the association was founded in 2019 ;</li> Roughly the equivalent of all articles written on our blog since its inauguration (not counting English translations) ;</li> 80% of the RGPD</a>;</li> 30% of the official guide to applying for a European grant</a>.</li> </ul> This work took place over a period of 8 months, from February to September, through the efforts of Brume, Doc and Neil. The source code is available here</a>. This article aims to present the main sections of this documentation, which is not solely technical. 🔗</a>Outreach activities</h3> The Activities section</a> contains all[^2] the transcripts we use for our conferences and activities. This is where you’ll find Brume’s workshop “How to make your association inclusive”</a> and the framework for the conference Les enjeux d’Internet</a>. In addition to serving as a framework, the instructions in this documentation are designed to let the speaker appropriate the content as he or she sees fit by detailing the design process for our activities, to make it easier for others to improve them later on. You’ll also find a record of our public interventions</a> and mentions of La Contre-Voie in the press</a>, on the radio or in podcasts. 🔗</a>Technical section</h3> This part of the documentation details our technical infrastructure and the software that makes it up. It replaces our former “technical report”, which was a single page containing a jumble of information about our infrastructure. However, this section does not include any installation tutorials, as the respective documentations for the software we use are already very well supplied and more regularly updated for this purpose. However, for each of our services</a>, we provide you with : average CPU, disk space and RAM consumption for each software component;</li> maintenance instructions for our specific needs, with a history of major changes made to the service;</li> precautions to be aware of before hosting a similar service, based on our experiences (both good and bad).</li> </ul> But this documentation isn’t limited to the services we let appear on our site</a>: it also covers all those you don’t see, but whose operation is vital to our entire infrastructure. These include : auxiliary services: our DNS resolver, our reverse-proxy, or our accounting software;</li> storage services: database management, network file storage or logging software;</li> monitoring (internal and external) or security software…</li> </ul> 🔗</a>Administrative</h3> We haven’t yet worked on the content, but we do have the structure: when this section will be finished, it will contain all the “major” administrative procedures that the association has followed since its creation, namely: application for recognition of general interest</a>, application for Jeunesse Éducation Populaire</a>;</li> grant applications (to date, we have not yet applied for any, but this will be done shortly);</li> keeping the association’s accounts;</li> drafting the annual moral and financial reports.</li> </ul> The time dedicated to administrative procedures within the association is in December, at the end of the calendar year. This documentation will be progressively updated from December onwards. 🔗</a>Communication tools</h3> Finally, this category details our communication tools, in the broadest sense: we consider a leaflet</a> or a sticker</a> to be communication tools. We therefore present each of these tools in detail, giving the illustrations used, our supplier, its price for the quantity ordered and the range chosen (weight, lamination, design…), as well as our opinion on the resulting print. The same goes for our T-shirts</a>, which you can find on our stands or on En Vente Libre</a>. Finally, we don’t forget to document our digital tools, and our internal and external communication strategies. 🔗</a>Review</h3> This year, we’ve focused our energies on consolidating the existing: we needed to take a step back to finally turn the page on four years of operation as a student association, take stock of what we’ve built and produced so far, and prepare ourselves for a new dynamic. We’re currently working on a technical solution that would enable us to log on to all our member services with a single account, the famous “unified authentication” (SSO). We’ve been talking to you about this for a long time, and the project has taken much longer than initially hoped, but we hope that this major technical change will enable us to expand our service offering in the future. As for the documentation, it’s not over yet: there are still a good ten pages to be written and almost the entire administrative section</a>. We hope to finish writing most of the missing pages by early 2024! See you soon, Neil [^1] Assuming it’s the same speech all the time</a>. [^2] Although still incomplete to date: some of our old transcripts</a> are obsolete and need updating before publication. The Legend of the FONJEP Grant Unknown — Wed, 21 Jun 2023 18:00:00 +0100 If you can’t find a story as epic as a hero striding through the lands of Hyrule, we’ll tell you the story of our little association’s journey to apply for a grant from the French administration (but don’t worry, there will be twists and turns too). Below is Neil’s account of our adventures. 🔗</a>Why do it?</h3> In our new economic model</a>, we were interested in the various subsidies allocated to associations, particularly in the field of popular education. After all, if our vocation is to intervene in educational establishments (and essentially in public establishments), it makes sense to us to be financed by public money. What’s more, the government approvals we’re able to obtain in this area are just as much guarantees of trust to convince school principals that we’re an association stamped “gentle” by the Government, and that it’s worth their while to finance us an intervention in their establishments (yes, these approvals really do serve this purpose). 🔗</a>Our plan</h3> We identified a two-stage approach: Apply for departmental JEP approval</a> (Jeunesse Éducation Populaire), awarded to associations involved in popular education activities.</li> Once JEP approval has been obtained, apply for the FONJEP grant</a>. Reserved for JEP-approved associations, the FONJEP subsidizes a salaried position in an association up to €7,100 per year for three years.</li> </ol> * 7,100€ is slightly less than half the cost of a part-time SMIC (70%). The total cost of the position would be around €16,000 a year, or €904 net for the salaried employee per month (who said anything about precariousness and self-exploitation?!). 🔗</a>Applying for JEP approval</h3> We’re now preparing the prerequisites for applying for JEP accreditation. There are two types of approval: national approval, which requires the association to be active in at least four different administrative regions;</li> départemental approval, which in our case would be issued by the Charente department (since we’ve moved our head office to Angoulême</a>.</li> </ul> We naturally turned to departmental approval, as we didn’t tick all the boxes for the other. 🔗</a>Prerequisites</h4> To qualify for this approval, we have to meet two categories of prerequisites, which you can find on this page</a>. The first category represents the common core of approval, which all associations applying for state approval must meet. Here are the criteria: Serve the public interest;</li> A democratic mode of operation;</li> Guarantee the association’s financial transparency;</li> Sign the republican commitment contract (even if we know what abuses it entails</a>).</li> </ol> We must then comply with the specific criteria for JEP approval: Be a registered association for more than three years;</li> Organize popular education or youth activities;</li> Guarantee strong democratic principles within the structure: freedom of conscience, the principle of non-discrimination and transparent management.</li> </ol> To proceed with the application, we need to send an email to a person designated as contact on the associations.gouv.fr website</a> containing all the required attachments. On March 13, we submitted our application by email, containing 14 (fourteen!!) attachments, all required</a> for processing our request: A letter signed by our president, Brume, stating the reasons for the request;</li> The notice of creation and modification of our association in the Journal Officiel, with our bylaws and internal regulations;</li> The list of members who make up our association’s governing bodies (our Bureau);</li> The latest transcripts of our general meetings;</li> Our moral and financial reports for 2021 and 2022;</li> Our projected budget;</li> A signed attestation committing our structure to the Republican Commitment Contract.</li> </ul> We received a reply the same day, from the recipient of our email who acknowledged receipt of our file and forwarded it (with a copy) to her manager. And now we have to wait four months. Unlike most administrative procedures, if the public administration fails to reply within this timeframe, our application is considered implicitly rejected. 🔗</a>A first call</h4> On May 30, after two and a half months of waiting in anguish, I broke down and decided to call the person in charge to ask him “if he had received our file and if it was complete”. A brief summary of our conversation. His reply: “Oh yes, indeed, I did receive your e-mail, but, er… well, it’s completely gone by the wayside. Sorry, it happens. But in any case, given your request, we were probably going to refuse if we had seen it, because your documents are signed with an address in Paris, so we would have considered that you are in Paris and that you have no reason to request approval in Charente”. Indeed, in March, we had not yet finalized the move of our head office to Angoulême, the application for domiciliation having been officially validated on April 29, 2023 (and funnily enough, the receipt declaring the change of head office was signed by… the head of JEP approvals himself, who obviously wears several hats!). However, we had no idea that the mention of a non-charentaise town in the signature of our documents (where it is common to sign “date, place and signature”) would be eliminatory for our file. But fortunately for us, the person in charge simply missed our email, so we weren’t turned down! Welcome to the wonderful world of French administration. So I ask him if it’s possible to examine our file, bearing in mind that we are indeed located in the Charente. “Yes, no problem, so you’ll still have to resend your file, changing all the signature locations, get them to re-sign and update the date. But don’t send it to me, I’ll be leaving the department within 24 hours, so I’ll give you an e-mail address…” We take note of the new e-mail address to which we send our file the next day. 🔗</a>A second call just in case</h4> Well, since the person in charge of our file had obviously left his post and our last mail had been ignored, we thought it would be a good idea to call back a week later (and not three months later) to ask if our file had been received and if it contained all the required documents. The answer from the person who took my call: “So, in fact, the person you called last week has left his post, and he has no replacement. His position is vacant at least until September, so we can’t process any more JEP applications until he’s replaced. Do you need it soon?” “AH. Well, ideally, to apply for FONJEP by the end of 2023 or early 2024?” “In that case, we can make an exception given the situation, you can try to submit a FONJEP application even if you don’t have the necessary approval. The next FONJEP applications will be processed in January 2024. Contact my colleague who deals with FONJEP approvals… “ Emotional elevator in my head, they like to do that at the administration, it’s probably to give an epic side to our journey. We note down his colleague’s telephone number, and call him a few days later at a prearranged time. 🔗</a>FONJEP</h3> The FONJEP grant, now within reach in this twisted situation, is one of the preferred ways of financing a salaried position within the association. Even at minimum wage part-time, even on a barely decent salary, even if you have to go through a whole heap of tax returns… getting paid is a bit more appealing than being a full-time volunteer, isn’t it? We’ve noted two types of FONJEP, listed on the Académie de Poitiers website, which we could fit into the boxes: the FONJEP JEP, the one that requires JEP approval (but which we could apply for without approval as an exception), which lasts three years and is renewable twice;</li> the FONJEP Jeunes, which focuses on the integration of young people into employment, does not require JEP approval, but only concerns future employees aged between 18 and 30 (which is just about the age range of everyone on our Contribution Committee), lasts for three years and is non-renewable.</li> </ul> How convenient: if they refuse the first, then we can ask for the other! 🔗</a>The FONJEP call</h4> Do you know that exhilarating feeling of finally reaching the final boss, after having obtained all the green lights, waivers, receipts and other A38 passes, and having talked to all the NPCs in the kingdom? That was pretty much how I felt at the time. I called, introduced myself and asked about FONJEP JEP. “Ah yes, you’re La Contre-Voie, my colleague told me about you [I’m getting to know all the people who work in this department, and obviously it’s mutual]. So, I’m going to have to stop you right there, because we really do have a lot of requests, so we only give priority to requests for full-time positions so as not to create insecure positions - and you’re asking for part-time. What’s more, we require the association to have been approved as a JEP for at least three years… whereas you don’t yet have approval.” I’m a bit taken aback at first, having read the 40-page circular</a> that describes this scheme and all the help pages on the government and Poitiers academy websites, I’ve never heard of this “3 years after approval” criterion, which seems to have been put in place in our department because of too many applications. I also appreciate the argument about the creation of precarious positions - it’s true that full-time volunteering for 5 years is a much more stable and permanent way of life. Much better paid… I then play our joker, the FONJEP Jeunes, justifying that we meet all the criteria for this FONJEP: “Oh no, but the FONJEP Jeunes was a one-shot deal, it was part of the “1 jeune 1 solution” scheme, they only did it for one year, it’s over, we don’t give any more. The information on the academy’s website isn’t up to date.“ In 20 seconds, this person has just ejected us from the set: back to square one! And so ends our long journey to apply for the FONJEP. The moral of the story: don’t wait 2 months before calling to see if your application has been received, and sign your documents at your head office address. We’ll be continuing our quest for other subsidies, approvals, certifications and other administrative recognitions, in the hope of finding a way to pay ourselves. In our sights at the moment: the FDVA for January 2024, grants from Nouvelle-Aquitaine and contact with the region’s SRANE (ex DANE). More in the next episode! ~ Neil The economic model we strive for Unknown — Sat, 11 Mar 2023 14:00:00 +0100 La Contre-Voie is a non-profit association : our goal is not to make money. How can a structure like ours exist under capitalism? This article presents how we wish to make the association economically viable. 🔗</a>A little background…</h3> Since 2019, we have been organizing awareness activities on digital ethics for neophyte audiences. We started as a student association under the name “42l”, within the 42Paris school. In July 2022, we decided to extend the scope of the association to pursue our mission by intervening in other schools : indeed, even if we are satisfied with what we had organized until now, we cannot be students forever, and we noticed that the need to raise awareness about digital issues was also present in other schools. We have therefore undertaken to radically change the identity of the association to become “La Contre-Voie”, giving ourselves the objective to intervene in other educational establishments (public or private): universities, high schools, colleges, but also third place</a> associations and popular education structures (MJC, media libraries…). In addition to this transformation, there is a new major constraint: in order for our activities to have more impact, and for us not to be satisfied with “promoting free culture in our free time”, we wish to constitute a salaried team within one or two years. So we need to adapt our business model to face this new situation. Eight months later, here is a first assessment of our reflection. 🔗</a>The volunteers of La Contre-Voie</h3> 2022 was the first year in which we experimented with valuing volunteer work</a> to the end: we therefore took the time to count the volunteer hours spent on the association and to estimate their financial value. This balance sheet is used to draw up a state of play of the volunteer activity within La Contre-Voie, but also to justify requests for subsidies, which could be useful to us during the year. One of the first indicators that this evaluation reveals is the number of volunteer hours and their distribution: we counted 3,006 hours of volunteer work for all the contributors of the association in 2022, of which 2,108 hours by one person and 505 hours by another person. These 3,006 hours of volunteer work are estimated at a total of 83,048 euros: in other words, if this time of work were remunerated in a company, this amount would correspond at least to the budget reserved for the remuneration of employees. You can find the details of this accounting in the appendix of our financial report</a>. 🔗</a>Volunteers for life?</h3> When La Contre-Voie was still a student association, we could devote ourselves fully to it in a entirely benevolent way: we were not yet subject to the imperatives of the job market and, for most of us, we were lucky enough not to have to depend on a part-time job on top of our studies in order to survive financially. Today, the situation is different: if most of us want to reserve our contribution to FOSS on our free time, some people would like to dedicate themselves to it full time. We need to have the means to do so. What funding model do we want? 🔗</a>Our current model</h3> Until now, according to our 2022 financial report</a>, we have mainly had three sources of funding: the sale of T-shirts (50%), the fees of our members, who benefit from our member-only services (21%) and donations from individuals - your donations! (28 %). In 2022, we had defined a budget forecast of 2,360 euros and finally collected 3,466 euros, which shows that this model works very well thanks to your support. But it goes without saying that if we want to pay an employee, we will not be able to rely on the sale of T-shirts: this would go against the principle of non-lucrativity of the association and it would require selling many (too many) T-shirts. We might as well start a t-shirt company next to our association activities at this stage… Among other expenses, if we intend to intervene in different places (and not just to integrate a school as before), this will generate a consequent increase of our travel expenses to go to the places, to eat on the spot and eventually to sleep on the spot if we can’t do otherwise. Thus, while a simple intervention in a school as a student association would cost us nothing, an intervention of one person in a distant place could cost us at least 130 euros (80 euros for a return trip by TGV, 40 euros for a night in a hotel and 10 euros for a meal). And that’s without counting the remuneration of the speakers! 🔗</a>The mirage of the salaried team</h3> To integrate a part-time employee would require a minimum annual budget of 12,000 euros just for remuneration (at the minimum wage and part-time, low estimate). Our budget for 2022 was less than 2,400 euros, we cannot multiply our budget by 6 in one year. This year, we have therefore defined a new annual budget of 4,800 euros, which means we doubled last year’s budget, and we hope to triple this budget next year to aim for a first remuneration in 2024, or even at the end of 2023 if we manage to find funding by then. The first contract will undoubtedly be relatively precarious and may not be a fixed-term or permanent contract: it may be an apprenticeship or professionalization contract, a paid internship, a work-study program, subsidized contracts (if they still exist), positions partially subsidized by public administrations (FONJEP)… we do not yet know what form this remuneration will take. In any case, we have this new need to remunerate as fairly as possible the people who devote time to the association’s missions, which implies looking for sources of financing. 🔗</a>Financing our interventions</h3> Our objective being to intervene in schools, several problems arise: Who finances our interventions? Can they be free? If not, at what amount? 🔗</a>Setting a price</h4> Let’s start with the most difficult one: the price of the intervention. A two-hour conference generally mobilizes one person for a whole half-day, if you count the travel time and preparation time on the day. But it will also have required hours of work beforehand (preparation of the content, slides, monitoring of the subject presented, regular updating of the content…). The gross hourly minimum wage being 11.27 € in 2023, we can therefore assume a minimum of six hours or 67.62 euros per person. If we take into account the level of qualification (which we arbitrarily value at 3 times the SMIC for the holding of a conference), the amount would be raised to 202.86 euros. This also means that this price would not cover the time our employee spends outside of this intervention, but necessary for the functioning of the association (for example, managing the administrative tasks of the association, developing tools or administering services… yes, we have multi-tasking profiles!) This is also without counting the travel expenses: if there is a need for a TGV trip, one can easily count 80 euros more. For a hotel, 40 euros more… We quickly arrive at very high amounts. One thing is sure: considering these amounts, choosing the free price could have as a consequence that La Contre-Voie is spending on these activities, whereas we are looking for the opposite (that it is a source of financing). For the moment, since 2023, we have chosen to fix an indicative amount at 100 euros per intervention, knowing that we are not (yet!) remunerated. We ask the structures to do according to their means and to decide if this amount seems to them fair and equitable, and we leave ourselves the freedom to adjust this price proposal according to the structure which invites us. 🔗</a>By subsidies?</h4> Our first thought was to ask for grants: after all, if we are going to work in public facilities, we think it makes sense to be funded by public money - in the same spirit as FSFE’s</a> Public Money, Public Code!</a> campaign. Unfortunately, the road to grants is long and winding: these grants are usually distributed in the form of calls for proposals restricted to a very specific activity that does not necessarily correspond to what we organize. The organizations that can distribute subsidies are very varied (the FDVA, the FONJEP, aid from communities and municipalities…), not to mention private funding (foundations…) or partnerships with specific institutions (the CAF, Pôle Emploi…). Some of these funds are conditional on obtaining departmental or national approvals (e.g.: Jeunesse Éducation Populaire) which we are in the process of requesting, but which will take some time to be studied. Finally, the request of any subsidy is conditioned to the signature of the Contrat d’Engagement Républicain</a>, which poses serious democratic problems, but which we will have to sign under constraint. 🔗</a>By the structures that invite us?</h4> It would make sense to ask for a financial contribution from the establishments that accept to receive us or that solicit us for an intervention. But in practice, it is not always possible. In the schools, we do not (yet) know of any “official” institutional channel that would frame a request for intervention. Our meeting with François Élie on February 9th (founding president of ADULLACT</a> and deputy mayor of Angoulême) reinforced this observation. From what we have heard from other popular education associations, this is essentially done through contacts within the institutions (technology teachers / ISN / SNT, student associations) rather than through the rectorate or the management. As a result, institutions do not necessarily have a budget for this type of intervention, and it seems unfair to ask teachers to pay out of their pockets. In the case of student associations, it is very variable: it depends on the annual budget of the association, if it is financially supported by its institution and the amount we ask. So far, in 2023, we have held an intervention at the school CyTech</a> (ex EISTI) in Pau, for the conference “Les enjeux d’Internet”. We were invited by La Corpauration, a student association in CyTech (thanks to them!). 🔗</a>In private schools?</h4> In other establishments, especially in the 42 schools (Paris, Angoulême, Lyon…) it is even more complicated to charge for our intervention. The GAFAM and other giants who intervene in these schools send employees to intervene in those schools, and therefore do not need to ask for a financial contribution from the schools. Sometimes, it is even the opposite: the company will pay the school to be invited! We know that it will be difficult to solicit contributions from these institutions. And yet, it is a particularly important audience to reach, because there are students (especially in computer science) in the middle of their professional training and subject to the influence of the digital giants. It is in the association’s objective to organize counter-influence activities to see the digital world from another angle than the GAFAM one. But is it fair to ask for a financial contribution from student associations, and in the same hand, to intervene for free in schools that does not want to pay us? No, it is not fair and not even economically viable. So we will have to change our strategy eventually. 🔗</a>By donations?</h4> This is the model chosen by some associations, including Framasoft</a> : but their scale is absolutely incomparable to ours (it’s a UFO duck ?!). Moreover, according to the survey that Framasoft conducted</a> in 2022 to know its public, it seems that the overwhelming majority of its contributors (82%) would ask to prioritize the maintenance of the services that Framasoft proposes following its De-google-ify Internet campaign</a>, much more than the awareness actions (35%). However, the people who know us online do not benefit directly from our interventions in schools (despite the recording of our conferences on PeerTube</a>). Would you fund activities that do not directly benefit you? Or it would mean expanding our service offerings, so spending more time working on services (at the expense of outreach, because we unfortunately cannot duplicate ourselves yet). In December 2022, we received a large number of donations from you. It made us feel like our work is appreciated and recognized, and it encourages us to keep going. Thank you!!! For 2023, it motivates us to try to go further, especially by carrying out interventions in places where we had not gone until now, despite their human and financial cost. 🔗</a>We need time</h3> There are many funding possibilities (and we have only mentioned a few here), but they all have one thing in common: they are long term, have major implications on the association’s budget (and therefore its survival) and cannot be realized overnight. We will need time to think about the best possible solution for us, so as not to enter into a lucrative logic (that’s a categorical no) nor to put the association in danger. Our reserve funds guarantee us a small security, but we must move forward carefully. In the meantime, we will continue to multiply our awareness activities and maintain our services, within the limits of available volunteer energy. We will also take some time to take a break, even for a short time, because we have already largely exhausted our volunteers in 2022 (see section on volunteer hours</a>), and even though time is running out to find funding, we are finding it difficult to maintain a cruising pace. We also understood the stake of developing a network, in particular to find places where to hold our events. This is why 2023 will be the year where we will try to participate in many gatherings (more than usual): FOSDEM</a>, JDLL</a>, Pas Sage en Seine</a>, CCCamp, CHATONS</a>, le Capitole du Libre</a>… We will try not to become the “origami booth association” either, because the core of our activity remains the awareness activities and the hosting of free services. See you soon, Neil for La Contre-Voie General Assembly of January 2023 Unknown — Sat, 28 Jan 2023 14:00:00 +0100 Hello, On January 21st, our General Assembly 2023 was held, gathering 11 people and closing the fourth year of exercise of La Contre-Voie. On the agenda, the usual subjects were quickly dealt with: the vote on the approval of the moral report</a> of the association, a presentation of the financial report</a>, the vote on the amount of the membership</a> and on the provisional budget</a>. Then came the other themes, less common for some, addressed in turn: a slight modification of the Statutes</a> of the association, the 2023 donation campaign, the realization of goodies, the subsidies and grants that we would like to apply for this year, the valorization of the volunteer work and so many other questions related to our associative life. 🔗</a>Some news from the Bureau!</h3> The General Assembly concluded with the election of a new Board: Neil, co-founder of the association, retires from the presidency to leave his place to Brume, co-founder, until now treasurer. Doc’, member of the Contribution Committee since 2019, takes over the treasury as of now. As for Neil, he joins the Contribution Committee in order to actively participate in the association’s missions outside the governing body, with the (still distant!) prospect of joining a future salaried team in 2024. Our Contribution Committee also welcomes two new members: Denise and Nanonej. 🔗</a>A new budget forecast</h3> With the agreement of the General Assembly, the Board has established a budget of 4 800 euros for the year 2023 (more than double the previous year!): now that La Contre-Voie is no longer a student association, we would like to give ourselves the means to go further. We will detail this budget in a future article. 🔗</a>The year in review</h3> A lot of ink has been spilled these last weeks, the association has organized more than 20 events during the year and it was time to take a step back on the work done. You will find here : A moral report</a> of 24 pages which details all our actions in 2022: our conferences, workshops, stands, meetings and online services, without forgetting the unavoidable statutory revision and our name change.</li> A financial report</a> of 15 pages, including eight pages dedicated to the details of each expense of the association, and seven pages dedicated to the valorization of volunteers.</li> The minutes of the General Assembly</a> of January 21, 2023 (7 pages), detailing the decisions taken and the topics discussed during this annual meeting.</li> </ul> We don’t know if our administrative paperwork will please some passionate readers… but you never know. See you soon, N&B The associations we support in 2022 Unknown — Wed, 28 Dec 2022 16:00:00 +0100 Hello, Like last year</a>, La Contre-Voie dedicates 15% to 20% of its surplus</a> on the previous year to contribute financially to structures of our choice. In 2021, the association has realized an exceptional surplus</a> of 1 341 euros, which would represent between 200 and 268 euros of donations. On December 18, we met with our Bureau and our Contribution Committee to select together the structures we wish to support. This year, we are supporting three organizations, for a total amount of 240 euros: 80 euros for the association Échap</a>, whose mission is to fight against sexist cyber-violence and who produce excellent guides</a> under free license, some of which are notably about digital hygiene;</li> 80 euros for the association Exarius</a>, a small but still young structure, member of the CHATONS collective</a> and maintained by students;</li> 80 euros for Le Cloud Girofle</a>, a CHATONS member association that also offers free alternative services.</li> </ul> We hope that this modest financial contribution from us - within our means - can help these associations to continue their activities. 🔗</a>Your donations received in December</h3> At the end of the year, we received even more financial support than we expected: 450 euros of donations in December (for a total of 542 euros in 2022). Your donations represent 18% of our funding this year. With membership fees</a> from our members and t-shirt sales</a>, our campaign ends with 125% of our funding goal achieved! Thank you for your support! We would like to thank especially the association Exodus Privacy</a> for their donation of 333 euros :) In 2023, we are going to give ourselves the means to organize more activities, that’s why we plan to progressively increase our annual budget. To continue our actions, your contribution is essential. We will detail the issue of financing our structure in a future article. In the meantime, have a great holiday season! N&B La Contre-Voie is coming to Angoulême Unknown — Wed, 21 Dec 2022 16:00:00 +0100 Hello everyone, In the perspective of organizing outreach activities outside of 42Paris, where we were a student association</a>, we are delighted to announce that La Contre-Voie will gradually move its headquarters to Angoulême, in Charente. It’s a new start for us: in one or two years, we hope to find a place in which to continue our popular education activities (conferences, workshops…) in order to reach a public not initiated to digital issues. Thus, it is in Charente that we will soon ask for our approvals and subsidies which could become necessary to continue our activities, in particular in schools (high schools, universities…), goal that we presented in one of our previous articles</a>. 🔗</a>Contribution to OpenStreetMap</h3> Google Maps, one of the flagship products of the eponymous multinational, has become - for many of us - an indispensable tool to travel. And yet, as for most of Google’s tools, it is a tool that is financed through the resale of our personal data (geolocation, search history…) and the integration of targeted ads</a> in the application. As a partner of choice for many public and private transportation companies (including STGA</a>, the bus company managing the transportation of the Grand Angoulême area), it has a monopolistic position in the field of mapping and navigation assistance worldwide. But fortunately, there is an alternative: a collaborative world map under a free license called OpenStreetMap</a>! This map, which can be modified by everyone in the manner of Wikipedia</a>, can be freely downloaded and reused in other projects and websites on the simple condition of crediting its contributors</a>. And since we use OpenStreetMap based software like OsmAnd</a> on a daily basis, we noticed that many street addresses were missing from the map. So we undertook to contribute to the map by adding several hundred street addresses from different databases (the cadastre</a>, the National Open Address Base</a>…). We also made a video to present how we did it: </a> 🔗</a>Meeting the local associations</h3> We got to know the collectives and activist groups in Angoulême, starting with the association Saxifraga</a>, which promotes artistic expression and the creation of convivial moments. We also participated in the Super Marché du Bêta, an event organized by Saxifraga that gathers about thirty associations and artists in front of the local of this association, called the Bêta. We went to the office of LAPLLA.NET</a> (L’Association pour la Promotion des Logiciels Libres en Angoumois et sur Internet), and met its members - some of whom we had met before at the Capitole du Libre</a>. We discovered the Cyclofficine d’Angoulême</a>, an association dedicated to bike repair, whose members also contribute to OpenStreetMap to provide useful information to cyclists. Finally, we held a conference at 42Angoulême</a> on December 5th, in order to raise awareness of Internet issues</a> among the new class of students. 🔗</a>Our goals for 2023</h3> We wish to develop our activities on the Charente territory and hope to intervene in schools to hold conferences on free software issues. For this, we will need : Move the association’s headquarters to Angoulême</li> To ask for and obtain approvals and maybe subsidies</li> To get in touch with the elected officials and local authorities to create links and organize new activities.</li> </ol> However, this sudden landing in Angoulême does not exclude us at all from intervening in other regions as we already do: we intend to continue our interventions in Paris (and notably in 42Paris) as long as we have the human and financial means. We will continue to give you news as the weeks go by. See you soon, N&B Feedback on the Capitole du Libre Unknown — Sun, 11 Dec 2022 16:00:00 +0100 On November 19th and 20th, a few dozen members of La Contre-Voie went to Toulouse, for the Capitole du Libre 2022</a>. Due to Covid, this annual event had not been organized since the 2019 session, in which we also participated. At that time, there were only two of us, under the name 42l, manning a half booth shared with the CHATONS. We have come a long way! 🔗</a>Evolution of the graphic charter</h2> In December 2019, we published an article featuring our old graphic design</a>. The change of name of the association</a> invited us to revise our whole graphic charter. Indeed, we wanted to get rid of any element referring to 42 and create our own image. This includes, for example, the triangular background that we used to use: it is the wallpaper used at school. We went for a rather stellar theme, reusing elements of the first T-Shirt we had produced. 🔗</a>Stickers</h3> The stickers are perhaps what required the least work. We had decided to keep our logo to make the link with the old identity of the association and not to confuse our public. So we only had to change the link on the sticker. The link was not the same size, so we had to move it slightly. We ordered these stickers in 1000 copies from StickerMule</a> for 211€, which is about 21 cents per unit. We had already ordered our previous stickers from them and are quite satisfied with the quality and the solidity of their stickers. 🔗</a>Tarp</h3> Our “Association 42l” tarp has followed us on many adventures, and we are more than indebted to it. Unfortunately, it is now time to part with it in favor of this new tarp: This tarp design is a basic adaptation of our banners for social networks. It is the same size as the previous one, 200x80cm, in PVC. We ordered it from the same supplier as our previous one: PixartPrinting</a>. We are very satisfied with our new tarp. I really advise any association, even a new one, to get one. It’s a very impactful communication element that plays a big role when we hold stands. Moreover, the prices are more than affordable (between 20 and 40€, ours cost 24€). 🔗</a>Business cards</h3> The creation of this new card design took me 8 hours of work in total. I really like working on business cards, it’s quite an enjoyable exercise. The front of the card uses the header elements of the website, and the back, in lighter colors, has a little cat silhouette to remind us of the CHATONS</a>. Our cards were also ordered from PixartPrinting, along with the tarp. Compared to the previous ones, we decided to use a laminated paper for a little more solidity, as well as rounded edges, which bring a refreshing touch to the cards. We ordered 1000 of them, for the sum of 80, or 8 cents per card. 🔗</a>A new T-shirt!</h3> Since changing our whole graphic charter was not enough, we also launched the printing of a new T-shirt! The last one was made in 2020, for the March 2020 JDLL, which did not take place due to the health crisis. This new design is themed around astronomy, to highlight the identity of the new graphic. I wanted to draw something related to mathematics (the trigonometric circle, the lines, the angles), space (the constellation of the logo, the stars, the planets), astrology (the phases of the moon), esotericism (the dream catcher, the crystals, the hanging trinkets). The lunar cycle is also scattered with small kittens to remind our collective and lighten the whole. This T-shirt, designated as the “Moons” series, was ordered in 100 copies at about 5.86€ each. We also recommended 60 “Constellations” T-shirts, for a total of 938,11€. Once again, we did not change the supplier for the T-shirts: it is Apparelo</a>, under the brand “Mon produit de com’”. The T-shirts are from the brand “BD Regent”. When we received the stock, we noticed a printing defect on the “Lunes” t-shirts. So we had to contact our supplier who sent us back 80 just in time for the Capitole du Libre. So we have 100 badly printed shirts (missing lines on the logo). We are now thinking about how to sell them. We’ll probably look into colorful embroidery to iron out the missing lines and create unique T-shirts, or maybe textile paint. These shirts are now available on En Vente Libre</a> ! You can order them for 17 euros each. 🔗</a>Summary of the event</h2> 🔗</a>Financial aspect</h3> All these restocking of communication tools, the important order of T-shirts at the end of the year and the other running costs of the association led us to foresee a deficit of 500 € at the end of the year. We hoped, as much as possible, to be able to make up this deficit at the Capitole in order to obtain a positive balance sheet at the closing of our fiscal year 2022. We are happy to say that this was a success! At the Capitole, we sold a total of 44 t-shirts at a price of 15€, for a total of 660€. We also got 30€ from memberships and 15€ from donations. Our deficit is therefore perfectly covered and we are even leaving the Capitole with a surplus of 200€, which leaves the association with a comfortable margin for the end of the year. As last year, we wish to make a donation to small structures that we will have selected beforehand. The choice of these structures is under consideration within our Contribution Committee. 🔗</a>Activities organized</h3> I held a 2-hour workshop entitled “Let’s audit your websites!” on Sunday. This workshop went very well. There were about 7-8 people, the workshop was smooth and enjoyable. We spent about 20 minutes per site, in a pleasant atmosphere. This workshop was previously held at the Summer 2022 CHATONS Camp and will likely be held again. It consists of looking at the audience’s sites to analyze them and give constructive feedback on general aesthetics, UI/UX, accessibility, etc. The introductory slideshow for the workshop can be downloaded here</a>. We had also planned to hold a conference, but unfortunately it was not accepted by the Capitole organizers. 🔗</a>Relationships</h3> On both days of the event, we had a booth in the CHATONS room. We came with a group of 10 people from 42 (7 people from 42Paris and 3 people from 42Angoulême). We used to organize such “school trips” regularly during free software conventions, but this was the first time we accompanied so many people. These students were able to enjoy the festival and also helped us to run our booth. We met a lot of people, like Framasoft</a>, LAPLLA.NET</a>, Exarius</a> and a lot of other people with whom we will undoubtedly build new things. We will talk about it in a future article! Thanks for these moments of sharing and see you soon, Brume

Drop your star</h3>

and donate to La Contre-Voie !</h4> </div> </a>

Drop your star</h3>

and donate to La Contre-Voie !</h4> </div> </a>

Drop your star</h3>

and donate to La Contre-Voie !</h4> </div> </a>
It’s thanks to you that we’re where we are. Thank you for your support, and see you next week for another article, less technical this time!</p>

Drop your star</h3>

Diving into the technical infrastructure of La Contre-Voie

Drop your star</h3>

and donate to La Contre-Voie !</h4> </div> </a>

Digital support: our modus operandi

🔗</a>Our recommendations</h5>
Here you’ll find, in no particular order, the “compromises” we’ve reached in recommending free solutions. These are biases, and they might make your hair stand on end, but you have the right to disagree, and we have the right to disagree with you too.</p>

Drop your star</h3>

and donate to La Contre-Voie !</h4> </div> </a>

La Contre-Voie is preparing its new services offer for you

Drop your star</h3>

and donate to La Contre-Voie !</h4> </div> </a>

CHATONS 2024 camp report

Our donations for other structures in 2023

Drop your star</h3>

and donate to La Contre-Voie !</h4> </div> </a>

Launch of our 2024-2026 roadmap

Drop your star</h3>

and donate to La Contre-Voie !</h4> </div> </a>

Introducing our new documentation

The Legend of the FONJEP Grant

The economic model we strive for

General Assembly of January 2023

The associations we support in 2022

La Contre-Voie is coming to Angoulême

Feedback on the Capitole du Libre

La Contre-Voie - News

ft_chatons: a last tribute to 42

La Contre-Voie has a tough time: help us stay on course!

New service: instant messaging with video conferencing

La Contre-Voie launches five new digital services

Outcomes, prospects and gifts to associations

Golden ticket to visit our service factories

A comparison of eleven open-source SSO solutions

La Contre-Voie - News

ft_chatons: a last tribute to 42

La Contre-Voie has a tough time: help us stay on course!

Drop your star</h3>

and donate to La Contre-Voie !</h4> </div> </a>

New service: instant messaging with video conferencing

La Contre-Voie launches five new digital services

Outcomes, prospects and gifts to associations

Drop your star</h3>

and donate to La Contre-Voie !</h4> </div> </a>

Golden ticket to visit our service factories

Drop your star</h3>

and donate to La Contre-Voie !</h4> </div> </a> It’s thanks to you that we’re where we are. Thank you for your support, and see you next week for another article, less technical this time!</p>

A comparison of eleven open-source SSO solutions

Drop your star</h3>

Diving into the technical infrastructure of La Contre-Voie

Drop your star</h3>

and donate to La Contre-Voie !</h4> </div> </a>

Digital support: our modus operandi

Drop your star</h3>

and donate to La Contre-Voie !</h4> </div> </a>

La Contre-Voie is preparing its new services offer for you

Newsletter</h3> To send out mass newsletters, from 20 to over 500 people, we set up a dedicated service, with optional tools to track subscriber engagement.</p>

Drop your star</h3>

and donate to La Contre-Voie !</h4> </div> </a>

CHATONS 2024 camp report

Our donations for other structures in 2023

and donate to La Contre-Voie !</h4> </div> </a>
It’s thanks to you that we’re where we are. Thank you for your support, and see you next week for another article, less technical this time!</p>