Serverless Patterns for the Paranoid: Building Sovereign Functions on Norwegian VPS

"Serverless" is the most dangerous misnomer in our industry. It implies magic. It implies you don't need to worry about the metal underneath. But anyone who has debugged a 3-second cold start on a Lambda function or tried to explain data residency to a lawyer after the Schrems II ruling knows the truth: There is always a server.

The question isn't whether you have servers; it's who controls them. In September 2020, relying blindly on US-based public clouds for event-driven architectures is a gamble. Between the unpredictable billing spikes and the data transfer legalities enforced by Datatilsynet, the smart move for European CTOs is shifting back to controlled environments.

I'm going to show you how to build a "Serverless" architecture that you actually own. We will use the Sidecar Pattern and Function-as-a-Service (FaaS) on top of lightweight Kubernetes (K3s), running on bare-metal capable KVM instances.

The Architecture: Why Self-Hosted FaaS?

When you deploy to AWS Lambda or Azure Functions, you are renting runtime by the millisecond. It sounds cheap until you hit scale. Then you realize you're paying a 400% markup on compute compared to a dedicated instance. Furthermore, your data is traversing opaque networks.

The alternative pattern gaining traction in Oslo's dev circles is OpenFaaS on K3s. This gives you the developer experience of serverless (faas-cli up) with the cost predictability and compliance of a local VPS.

The Stack

• Infrastructure: CoolVDS NVMe KVM Instance (CentOS 8 or Ubuntu 20.04).
• Orchestrator: K3s (Lightweight Kubernetes).
• FaaS Framework: OpenFaaS.
• Gateway: Nginx / Traefik.

Pro Tip: Don't try this on standard HDD VPS. Serverless relies heavily on container spin-up speed. If your disk I/O wait is high, your functions will time out before they start. We use NVMe storage on CoolVDS specifically to mitigate the "cold start" latency that plagues container orchestration.

Step 1: The Foundation (K3s)

We don't need the bloat of full Kubernetes (k8s). K3s is a compliant, lightweight distribution ideal for a single high-power VPS. Here is how we bootstrap it on a fresh node.

# Install K3s (lightweight k8s)
curl -sfL https://get.k3s.io | sh -

# Check the node status
sudo k3s kubectl get node

# Expected output:
# NAME          STATUS   ROLES    AGE   VERSION
# coolvds-01    Ready    master   25s   v1.18.8+k3s1

Once K3s is running, we have a container orchestration platform that consumes less than 500MB of RAM, leaving the rest for your actual application logic.

Step 2: Deploying the Serverless Framework

OpenFaaS sits on top of Kubernetes. It provides the API Gateway and the Watchdog component that translates HTTP requests into standard input for your functions.

First, we install `arkade`, a tool to manage Kubernetes apps, which simplifies the OpenFaaS install significantly compared to raw Helm charts.

# Get arkade
curl -sLS https://dl.get-arkade.dev | sudo sh

# Install OpenFaaS
arkade install openfaas

# Retrieve your password
PASSWORD=$(kubectl get secret -n openfaas basic-auth -o jsonpath="{.data.basic-auth-password}" | base64 --decode; echo)

# Login via CLI
faas-cli login --username admin --password $PASSWORD

At this point, you have a functional serverless platform running inside your CoolVDS instance. Data never leaves the server unless you tell it to.

Step 3: The "Video Resizer" Pattern

Let's look at a real-world scenario: Image or Video resizing. Doing this synchronously in your main PHP or Node.js web app is a disaster for performance. The browser hangs while the server crunches pixels.

Instead, we use an asynchronous event pattern.

1. User uploads file to your application.
2. App saves file to storage and fires a notification to NATS (messaging system included in OpenFaaS).
3. The `resizer` function wakes up, processes the video, and shuts down.

Here is a Python function handler for OpenFaaS:

def handle(req):
    import os
    from PIL import Image
    import io

    # 'req' contains the image bytes
    try:
        image = Image.open(io.BytesIO(req.encode('utf-8')))
        image.thumbnail((128, 128))
        
        # Save logic here (omitted for brevity)
        return "Resized successfully"
    except Exception as e:
        return str(e)

Deploying this is instantaneous:

faas-cli up -f resizer.yml

Performance Tuning: Avoiding the "Cold Start"

In a public cloud, if your function isn't called for 10 minutes, the provider kills the container. The next request waits 2-5 seconds for a boot. This is unacceptable for user-facing APIs.

On your own CoolVDS infrastructure, you control the scaling rules. You can define a minimum replica count to ensure at least one hot container is always ready.

# resizer.yml configuration
version: 1.0
provider:
  name: openfaas
  gateway: http://127.0.0.1:8080
functions:
  resizer:
    lang: python3
    handler: ./resizer
    image: resizer:latest
    labels:
      com.openfaas.scale.min: 1  # KEEP ONE INSTANCE ALIVE
      com.openfaas.scale.max: 10
      com.openfaas.scale.factor: 20

This configuration keeps the latency under 50ms, something virtually impossible to guarantee on standard AWS Lambda tiers without paying for "Provisioned Concurrency."

The Hardware Reality: NVMe and KVM

Virtualization overhead is the enemy of micro-VMs and containers. If your hosting provider uses OpenVZ or LXC, you might run into kernel version conflicts when trying to run K3s or Docker deeply nested. This is why we insist on KVM (Kernel-based Virtual Machine).

Furthermore, when 10 functions fire simultaneously, they all demand disk I/O to load libraries. On spinning rust (HDD) or shared SATA SSDs, the iowait spikes, and the CPU sits idle waiting for data.

Benchmark: 100 Concurrent Functions

Legal & Compliance (Schrems II)

Since the CJEU invalidated the Privacy Shield framework in July, transferring personal data to US-owned cloud providers has become a compliance minefield. Even if you choose a "Frankfurt" region, the US CLOUD Act can theoretically compel data access.

Hosting your FaaS architecture on a Norwegian VPS provider like CoolVDS creates a clear legal boundary. Your data resides in Oslo or European datacenters, governed by EEA law, without the sub-processor complexity of the hyperscalers.

Summary

Serverless is a powerful architectural pattern, but it shouldn't cost you your sovereignty or your budget. By using tools like K3s and OpenFaaS, you gain the agility of event-driven code deployment while retaining the raw performance of bare-metal isolation.

Don't let latency or legal ambiguity dictate your infrastructure. Deploy a CoolVDS NVMe instance today and build a serverless platform that actually serves you.