Nextcloud announced on November 3, and It's FOSS and GNU/Linux.ch filled in the procurement detail that actually matters: govdigital eG awarded IONOS the framework contract for KoDaS — a file-hosting and collaboration solution for schools — after a public procurement conducted on behalf of the Pädagogische Cloud Infrastruktur (PCI), a cross-state undertaking of Berlin, Bremen, Hamburg, Hessen, Nordrhein-Westfalen and Rheinland-Pfalz, funded by the DigitalPakt Schule. IONOS is the general contractor responsible for building, migrating, and operating the service in German data centers; Nextcloud is the open-source technology inside it, sold as IONOS Nextcloud Workspace.

Six states, other German states able to join, schools and school authorities able to take it or leave it. Nobody is mandated to adopt. That last point is the difference between a sovereign option and a sovereign mandate, and the announcement is explicit about it in both sources.

The tender is the artifact

The TED notice — reported and quoted by It's FOSS — is the document a community should steal from, so here are the requirements in one place:

| Requirement | Value | | --- | --- | | License | OSI-approved open source only — citing digital sovereignty, lasting availability, and the ability to switch providers | | Contract ceiling | €67.5 million maximum, 48 months maximum term | | Security | ISO 27001 certification | | Company floor | ≥ €10 million turnover; ≥ €5 million liability insurance | | Reference project | ≥ 10,000 active users on fully separated tenants | | Features | Central file hosting and sharing, browser-based office suite, calendar and contacts, integrated email client | | Pricing | Five tiers by active users: up to 50,000 → above 500,000; no volume commitment |

Three of these lines are the whole lesson.

The license line makes the exit real. Public tenders say "switchability" all the time. This one tied it to something verifiable: an OSI-approved open-source license. If the contract ends, the next contractor can take the actual code and the actual data, because the code's license permits it. That is the difference between an exit clause and a hostage situation, and it cost the buyers nothing to write in.

The 10,000-user separated-tenant reference is a credibility gate. It excludes pilots, PowerPoint consortia, and the vendor who has never run multi-tenant at scale. For a community buyer, the equivalent is smaller by an order of magnitude — but the shape is the same: demand proof of an operating deployment at your scale, with the tenant isolation you intend to rely on, before the award rather than after it.

Active-user pricing with no volume commitment protects small adopters. The five tiers go from under 50,000 to above 500,000 users, and nobody commits to a number up front. A small school authority starts at its actual current user count and grows into the pricing as adoption grows. Compare that to the standard enterprise contract structure, where the discount depends on the seat floor you locked in for three years. For a community, this is the pricing model that lets the skeptics join late without renegotiating anything.

The vehicle: joint procurement, shared operations

The second copyable structure is who did the buying. No individual school tendered this. The Pädagogische Cloud Infrastruktur is a joint cloud-operations platform of the six participating states — shared operating services, monitoring, security mechanisms, and platform services underneath education applications — and it ran the procurement once, on behalf of everyone. govdigital eG, a German public-sector IT cooperative, executed it. govdigital's COO put the point plainly: KoDaS shows how joint procurement across state borders works.

This site wrote in September that community infrastructure already runs on open source and the procurement has to catch up. KoDaS is procurement catching up, and the mechanism matches the known failure mode: the per-institution DIY path works until it stops, usually at the staffing line. A reader on GNU/Linux.ch said it without decoration — when each school cooks its own broth, the result depends on network staff the school never had. The Mecklenburg-Vorpommern migration is the same arithmetic from the state side: one Nextcloud, one operator team, 50,000 users planned — not fifty instances and fifty sysadmins you cannot hire.

None of this is unique to Germany. Three German states share one Kubernetes platform, and the pattern transfers down scale nearly unchanged: a handful of fire halls can run one joint tender with one shared operations budget instead of five of each. The coordination cost is the real price, and KoDaS shows the receipt it buys.

What KoDaS is not

The honest column, because the announcement will not provide it.

It is not self-hosting. IONOS operates the service in its German data centers. The sovereignty here is jurisdiction sovereignty: European company, German law, EU law, open-source license, contract-backed exit. A managed service is a legitimate sovereign option — it is just not the same option as running the box yourself, and the difference shows up in who can read the ops logs, who patches the kernel, and what happens between the notice period and the contract end. Communities that can self-host should keep doing it; institutions that cannot staff it should notice that the tender's license requirement is what stops the managed service from becoming unmovable.

The €67.5 million is a ceiling, not a spend. The notice sets a maximum value and a maximum term; neither the announcement nor the coverage states the actual contract value. Treat both numbers as bounds, not facts.

One vendor is still one vendor. IONOS is the main contractor with a partner consortium behind it. The tender's switchability requirement is the mitigation, not a guarantee that switching will be cheap — it guarantees it will be possible. The difference in effort between possible and cheap is exactly what the reference-project and license requirements are supposed to contain.

Opt-in means the take-rate decides. This is the same number that decided whether Lehi's fiber build was validated by reality or by projection, and the same honesty this site demanded from AWS's sovereignty drill: artifacts, not quotes. The press release announces optionality. The number to watch in twelve months is how many school authorities actually ordered, at which tier, growing at what rate. Until then, KoDaS is an option that exists — which is already more than most communities have — but it is not yet an outcome.

Worth one footnote while we are here: this is the second German public-sector Nextcloud story this site has covered, and the open-source license came through a growth investor, which none of these procurement outcomes changed. The license is the contract-level constant, and here it is the buyer — not the vendor's marketing page — that put it in writing.