Show HN: 1-Click Migration Solution

Flareover, an open-source migration tool, reads existing edge configurations from providers like Cloudflare and rebuilds them faithfully on EU-based servers using self-hosted software such as Caddy and PowerDNS. The tool never guesses on config mappings, flags ambiguities for user decisions, and includes a parity gate that blocks cutover unless behavior is identical. This provides a lock-in-free, deterministic migration path with no egress fees.

flareover reads your existing edge setup — DNS, TLS certificates, redirects, WAF rules, caching — and rebuilds it faithfully on your own EU servers open-source, self-hosted . It never emits config that silently changes how your site behaves: what it can't map exactly, it asks about or flags — it never guesses . ● AGPL-3.0 · self-hostable · no lock-in Every element of your edge gets exactly one verdict. Behavior-changing config is emitted only when equivalence is proven or you answer a bounded yes/no. That honesty is the product. A provably-equivalent target mapping exists. Config is generated. A faithful mapping exists with one enumerable ambiguity. A single yes/no resolves it — cached, reviewable. No faithful mapping arbitrary edge code, ML bot-scoring . Surfaced with a reason, never guessed . Read-only extraction to a gated, reversible cutover. Every step is deterministic; the parity gate blocks the flip unless the new edge behaves identically. The engine tells you exactly what carries, what needs a decision, and what it won't touch — before anything changes. bash $ flareover assess zone.snapshot.json ╭─ flareover · assessment · example.com ─────────────╮ │ 43 elements ● 31 AUTO ● 11 ASK ● 1 MANUAL ╰────────────────────────────────────────────────────╯ MANUAL 1 ● config-rule tweak features on /api → — Provider-only edge feature email obfuscation : no Caddy equivalent. ASK 11 ● dns A app.example.com → powerdns ? Real origin host:port behind the orange cloud? AUTO 31 ● tls hsts → caddy ● waf-custom block bad UA → caddy-waf ● redirect apex → www → caddy A real zone was migrated and cut over off its old managed edge, then verified end-to-end. The parity gate first blocked a divergence, and only passed once the new edge behaved identically — these are the checks it ran: GATE: PASS no behavior-changing divergence — cutover permitted. No traffic or egress fees. No exposure to a future price or policy change. Every target is tagged with its jurisdiction, so the migration provably stays EU-scoped. | Concern | Tool | where | |---|---|---| | Authoritative DNS | PowerDNS | EU | | Reverse proxy · TLS · HTTP/3 | Caddy | free | | WAF | caddy-waf | free | | Edge cache | souin | free | | Certificates | CertMate · Let's Encrypt / Actalis | EU CA option | | Object storage S3-compatible → | MinIO | no egress fee | | Landing zone | refurbished bare metal → Proxmox → LXC | EU | The same 0% FP discipline migrates S3-compatible object storage R2, S3, … onto sovereign MinIO. The engine maps the configuration; rclone copies the data — into the EU, with no egress fee. A public bucket is never made public without your explicit yes; an IAM policy is flagged, never guessed.