# Show HN: 1-Click Migration Solution

> Source: <https://www.flareover.com>
> Published: 2026-07-08 11:53:56+00:00

**flareover** reads your existing edge setup — DNS, TLS certificates, redirects,
WAF rules, caching — and rebuilds it faithfully on your own EU servers (open-source,
self-hosted). It never emits config that silently changes how your site behaves: what it can't
map exactly, it asks about or flags — **it never guesses**.

● AGPL-3.0 · self-hostable · no lock-in

Every element of your edge gets exactly one verdict. Behavior-changing config is emitted only when equivalence is proven or you answer a bounded yes/no. That honesty is the product.

A provably-equivalent target mapping exists. Config is generated.

A faithful mapping exists with one enumerable ambiguity. A single yes/no resolves it — cached, reviewable.

No faithful mapping (arbitrary edge code, ML bot-scoring). Surfaced with a reason, **never guessed**.

Read-only extraction to a gated, reversible cutover. Every step is deterministic; the parity gate blocks the flip unless the new edge behaves identically.

The engine tells you exactly what carries, what needs a decision, and what it won't touch — before anything changes.

``` bash
$ flareover assess zone.snapshot.json

╭─ flareover · assessment · example.com ─────────────╮
│ 43 elements   ● 31 AUTO   ● 11 ASK   ● 1 MANUAL
╰────────────────────────────────────────────────────╯

 MANUAL  (1)
  ● config-rule  tweak features on /api  → —
     Provider-only edge feature (email obfuscation): no Caddy equivalent.

 ASK  (11)
  ● dns  A app.example.com  → powerdns
     ? Real origin (host:port) behind the orange cloud?

 AUTO  (31)
  ● tls  hsts  → caddy
  ● waf-custom  block bad UA  → caddy-waf
  ● redirect  apex → www  → caddy
```

A real zone was migrated and cut over off its old managed edge, then verified
end-to-end. The parity gate **first blocked** a divergence, and only passed once the new edge
behaved identically — these are the checks it ran:

GATE: PASS no behavior-changing divergence — cutover permitted.

No traffic or egress fees. No exposure to a future price or policy change. Every target is tagged with its jurisdiction, so the migration provably stays EU-scoped.

| Concern | Tool | where |
|---|---|---|
| Authoritative DNS | PowerDNS | EU |
| Reverse proxy · TLS · HTTP/3 | Caddy | free |
| WAF | caddy-waf | free |
| Edge cache | souin | free |
| Certificates | CertMate · Let's Encrypt / Actalis | EU CA option |
| Object storage (S3-compatible →) | MinIO | no egress fee |
| Landing zone | refurbished bare metal → Proxmox → LXC | EU |

The same 0% FP discipline migrates S3-compatible object storage (R2, S3, …) onto sovereign MinIO. The engine maps the configuration; rclone copies the data — into the EU, with no egress fee. A public bucket is never made public without your explicit yes; an IAM policy is flagged, never guessed.