The recurring finding on this site is that the tools are mature and the money is aimed wrong: procurement funds the ribbon-cutting, not the runbook, the training, or the second operator. Most grants in this space fund building the new thing. Almost none fund keeping the existing thing alive.

The NLnet Foundation's Restack programme is a partial exception, and its first open calls are live now.

What it is

Restack is NLnet's cascade-funding programme under the European Commission's Open Internet Stack initiative — the successor to the Next Generation Internet (NGI) programme that funded a decade of internet commons work through NGI Zero. The Commission selected the NLnet-led consortium (with FSFE, Radically Open Security, NixOS Foundation, APC, OW2, and others) at FOSDEM in January 2026. Between now and 2030 it will award €7 million in small and medium R&D grants, plus practical support: security audits, accessibility scans, reproducible packaging, copyright and governance help.

Key dates and amounts:

  • First call deadline: November 3, 2026, 12:00 CET — announced September 3, calls then roll every two months (third of each odd month) until the budget is allocated
  • First proposal: €5,000–€50,000. Larger projects (up to €150,000) must be preceded by a successfully concluded smaller project within Restack or an equivalent NGI programme
  • Hard ceiling per grantee: €500,000 over the programme lifetime
  • License requirement: non-negotiable. All software and hardware outcomes must ship under a recognized free or open source license; research outcomes must be open access. The guide for applicants states that projects above €50k must also pass an independent security audit and resolve findings before a follow-up can be granted

Two themed funds are taking applications this cycle: Restack (building a scalable open internet stack — core infrastructure, alternatives to closed online services, secure and privacy-friendly end-user devices, supply chain security, reproducibility) and CodeSupply (software supply chain security through packaging metadata).

Scope, concretely

The fund's own description is refreshingly unglamorous about what counts: libre chips, middleware without vendor lock-in, productivity tools, local-first infrastructure, and the end-user applications that consume networked services. Improving and decoupling infrastructure layers. Deployment innovation. Client-side counterparts to server-side services. Full-stack security. Reproducible builds.

Translated to the stack this site keeps recommending: a tested migration path off a proprietary management plane, a self-hosted alternative hardened to production grade, packaging that makes a community deployment reproducible, an audit of the thing a fire hall actually runs. This is the funding shape the Brazil ISP study said was missing — not more access points, but the ecosystem around the code. The NGI Zero lineage has a track record here: Fediversity (pre-integrated Nextcloud/Mastodon/Matrix/Tailscale deployment stacks — directly aimed at community clouds), Taler, and hundreds of small grants that matured tools communities now run daily.

The honest caveats

It is not community-network operating money. Restack funds R&D on technology commons, not an ISP's construction budget or a nonprofit's server bill. If your community needs connectivity, this is not your instrument. It is for the software, standards, and documentation layers underneath.

The scale is small by design. €5,000–€50,000 is a maintainer's stipend and a security audit, not a company's roadmap. That is the point — NGI Zero's model has always been small, fast, low-bureaucracy cycles — but it means the fund strengthens ecosystems rather than financing deployments.

The licensing bar is real. Outcomes must ship entirely under a recognized open license, with WCAG-compliant deliverables for larger projects and audit findings dealt with before follow-ons. Projects that want to keep parts proprietary should not apply.

First proposals max at €50k, and the path to €150k runs through a completed prior grant. Plan accordingly.

Why it matters

The sovereignty conversation keeps producing strategy documents — the Commission's open source strategy, Germany's binding open-standards decision, national cloud blueprints. Restack is the rare instrument that funds the actual work at the level where it happens: individual maintainers and small teams, with short funding cycles and no obligation to produce a slide deck about ecosystems. The programme's own framing is blunt: "no digital sovereignty without putting in the actual work."

If you maintain a piece of the community infrastructure stack — the deployment tooling, the self-hosted platform integration, the migration documentation nobody else will write — the November 3 deadline is two months out, and the application is a proposal, not a corporate grant process. The NGI Zero playbook this fund inherits has funded hundreds of small teams exactly like the ones this site writes for.

The stack will not restack itself.

Sources: NLnet Restack programme; Restack guide for applicants; NLnet call announcement, September 3, 2026; NLnet selection announcement, January 31, 2026.