The Nokkela Blog
Practical articles on IT infrastructure, IT security and AI – grounded and hands-on. This is where we share current thinking from our various specialist fields and what actually works in real projects across the DACH region, Scandinavia and beyond.
One instance per customer – scaling .NET, SQL Server and S3 worldwide
One Windows VM running IIS, one MSSQL server and S3 for the documents – once per customer. That model carries you surprisingly far, but it breaks at three predictable points: licence cost, maintenance windows and distance. We map the route in four stages – up to one complete, self-contained copy of the solution per world region – and say plainly which stage most vendors actually need.
From one VM per customer to a worldwide fleet: the stages, regional cells, the tenant catalogue, data residency and the licence arithmetic that decides everything in the end.
Read article →The geopolitics of AI models and Europe's sovereignty
US closed source, Chinese open weights with a political imprint, Europe with Mistral – and why the operating model decides sovereignty.
Read article →Distribute a /56 IPv6 to every edge over IPsec
Complex routing on Palo Alto: a /56 over an IPsec hub-and-spoke with ULA routing between the tunnel endpoints.
Read article →What we write about
We write about three fields we work in every day: IT infrastructure, meaning on-premise, managed and hosted services; IT and network security with Palo Alto Networks and Zero Trust from European data centres; and artificial intelligence, hosted in Europe or on-premise at your site. Each topic links to the specialised site behind it.
Knowledge from the Nokkela fields of expertise
This blog is where the specialist fields of Nokkela-IT-Concept GmbH publish what they have learned in real projects. We write from our own operational practice rather than from marketing material, we work open-source-first and independently of vendors, and we stand for European digital sovereignty in how we build and operate systems.
All articles at a glance
This archive lists our earlier articles in chronological order, each with its date, topic area and reading time. You will find the Proxmox 9 GPU passthrough guide for a vLLM server, the self-hosted RAG walkthrough built on Qdrant, BGE-M3 and a local LLM, and the honest comparison of managed services and in-house operations. Every entry opens to a short summary and links straight to the full article.
Configure Proxmox 9 with a GPU for a vLLM VM
08/03/2026 · Infrastructure & AI · 18 min read
Pass an NVIDIA GPU through to a VM via IOMMU/VFIO and run vLLM as an OpenAI-compatible LLM server – from the BIOS settings to the verification step.
Self-hosted RAG: GDPR-compliant search
08/02/2026 · AI & GDPR · 16 min read
Make your own documents searchable locally – with Qdrant, BGE-M3, reranking and a local LLM. Data sovereignty guaranteed, including the right to erasure.
Managed services vs. in-house operations
08/01/2026 · Infrastructure & strategy · 12 min read
When each path pays off – an honest comparison of cost, control, expertise and risk, with a comparison table and decision checklist.
Questions about this blog
Below are the questions we are asked most often about this area. Each answer is written to stand on its own, so it stays correct when quoted alone.
What topics does the Nokkela blog cover?
The Nokkela blog covers three strands: IT infrastructure, IT and network security, and artificial intelligence. Each strand maps to a specialised field — nokkela.systems for on-premise, managed and hosted services, nokkela.network for Palo Alto Networks and Zero Trust, nokkela.ai for sovereign AI. Published so far: scaling a one-instance-per-customer solution on .NET, SQL Server and S3 worldwide, Proxmox 9 GPU passthrough for vLLM, IPv6 over IPsec on PAN-OS, self-hosted RAG, managed versus in-house operations and the geopolitics of AI models.
Are the tutorials on the Nokkela blog reproducible in my own environment?
The tutorials on the Nokkela blog are written as reproducible step-by-step guides that name the exact versions used. The Proxmox guide, for example, runs on Proxmox VE 9.0 — Debian 13 Trixie, Linux kernel 6.14, QEMU 10 — and walks from BIOS/UEFI settings through IOMMU kernel parameters, the VFIO modules and binding the GPU to vfio-pci, to a q35/OVMF virtual machine with Ubuntu 24.04 LTS. Every guide closes with a verification step and troubleshooting.
How do you scale a one-instance-per-customer solution on .NET and SQL Server worldwide?
The Nokkela blog sets this out in four stages. First the web, database and object storage layers become separate building blocks and many tenants are pooled onto one SQL instance — one database per tenant. Then comes the first complete cell: several stateless IIS nodes behind a load balancer, MSSQL with a replica in the same region and backups protected by object lock. Only after that is the cell replicated into further regions, steered by a tenant catalogue. The one rule that carries the whole design: a tenant's application, database and document storage always sit in the same data centre.
Which stack does the Nokkela blog use for a self-hosted RAG system?
The self-hosted RAG guide on the Nokkela blog combines four building blocks: Qdrant as the vector database, BGE-M3 for multilingual embeddings, a reranking step and a local language model served by vLLM. Because every step runs on your own hardware, neither documents nor questions leave the network. New documents are indexed rather than trained in, so they are available immediately and can be deleted at any time — which is how the guide addresses the right to erasure.
How can a delegated /56 IPv6 prefix be distributed to several sites over IPsec?
The Palo Alto guide on the Nokkela blog builds a hub-and-spoke on PAN-OS: headquarters terminates the provider-delegated /56, every edge site receives its own /64, and each edge attaches over one IPsec tunnel. We number the tunnel interfaces with ULA addresses (RFC 4193) and use them as the next hop, so the public prefix stays reserved for production devices and the routing survives a change of the delegated /56. Static routes suit a few sites; BGP over the ULAs scales to many.
Does the Nokkela blog say whether managed services or in-house operation is cheaper?
The Nokkela blog gives no blanket answer on cost, because what matters is the total cost of ownership, not the monthly invoice alone. In-house operation offers maximum control and customisation, but demands expertise, staff and upfront investment; managed services offer predictable costs and offload in exchange for a degree of steering. The hybrid, co-managed middle ground lets the provider run the base while application and data sovereignty stay with the customer. Our rule of thumb: keep the core in-house, outsource standard operations.
Which AI models does the Nokkela blog regard as sovereign?
The Nokkela blog argues that sovereignty depends less on a model's origin than on its operating model: open weights run on your own hardware. US commercial flagship models are mostly closed and under US jurisdiction, although several US providers also ship open weights. Chinese open-weights models are locally runnable but content-imprinted, and Europe is represented most visibly by Mistral, alongside Aleph Alpha, OpenEuroLLM and Teuken. We therefore weigh the deployment model, not just the leaderboard.
Does reading the Nokkela blog set cookies or load external trackers?
The Nokkela blog sets no marketing or analytics cookies and loads no external fonts, maps, analytics or tracking services — it is delivered as static HTML. Cloudflare sits in front as a reverse proxy against attacks such as DDoS, and for users in Europe we have explicitly disabled its tracking. Data is processed primarily within the EU/EEA, on servers in Germany and Finland. The privacy notice linked in the footer sets out the detail.