Frozen document. Dates and status refer to its original source. Private resources and unreviewed images are unavailable.
Free alternatives to MuleSoft and CloudHub
Historical integration alternatives. ADR 0010 selects local certification followed by hosted UI and cloud VPS using the accepted BFF. MuleSoft remains later-phase; the proposal below remains research.
Status: researched proposals, 2026-09-23. The owner requested exploration of replacements, not selection. ADR 0007 remains accepted until explicitly superseded. Evaluate free replacements for the MuleSoft CloudHub API layer records the findings.
First separate hosting from connectivity
CloudHub introduced a cloud caller into the earlier local-backend layout. It did not uniquely require a tunnel. Any hosted API service must reach the backend and identity endpoints it calls. Replacing CloudHub while leaving those services on an unreachable Mac preserves the same connectivity problem.
| Layout | Inbound route to Mac needed? |
|---|
| Hosted integration layer, backend/Keycloak on Mac | Yes, for the selected direct API architecture; a tunnel or private connection is one solution |
| Hosted integration layer, backend/Keycloak in cloud | No; the Mac runs the UI and makes outbound requests |
| Local integration layer, backend/Keycloak on Mac | No, if Contentful content is pulled outbound and no remote callbacks are configured |
An outbound polling relay is another design possibility, but changes synchronous queries, latency and failure handling. It is not a free replacement of the current direct API contract.
Recommendation for the hosted option
Evaluate Cloudflare Workers Free as a small TypeScript Experience/System API layer, with the backend, Keycloak, Camunda, PostgreSQL and scanner on the chosen cloud host. Keep Contentful on its suitable SaaS plan. This would remove the need for CloudHub hosting if the owner accepts the replacement, and avoids an inbound Mac connection because the remaining backend services also live in cloud.
Workers can supply the runtime for our routing, authorized aggregation, input validation, mapping and HTTPS adapters. We implement those capabilities. It does not provide a Mule runtime, DataWeave, its connector catalog or Anypoint governance. That tradeoff is plausible for Atlas because the legacy systems are simulated REST APIs and Camunda already owns business workflows.
The Free tier has 100,000 requests/day and a 10 ms CPU budget per invocation. Authentication and schema transformations need an actual CPU test; request volume alone cannot prove a fit. Cloudflare notes that heavier authentication/payload workloads can use 10–20 ms, so the Free tier is a candidate requiring proof, not an assured fit. Stream the accepted 10 MiB document transfers and leave scanning in the backend. Do not upgrade automatically if the free budget fails. Workers pricing, limits.
Alternatives and their actual free status
| Candidate | Free status | Atlas fit |
|---|
| Cloudflare Workers | Recurring hosted Free tier within quotas | Preferred hosted code-runtime experiment; implement and test the API layer ourselves |
| Azure API Management Consumption | Included allowance of one million API operations monthly per Azure subscription, subject to its offer; extras and overage may cost | Stronger managed API policy option; custom integration code/compute still needed where policies are insufficient |
| WSO2 Integration Platform / Developer Platform | Integration Platform has a 30-day trial; Developer Platform replaced its new-user Free tier with a 14-day trial | Relevant platform capabilities, but no ongoing free entitlement established for Atlas |
| Pipedream | Free plan with credit, workflow and account limits; exact current quota unverified | Auxiliary automation candidate; primary portal API behavior remains unproven |
| Make | 1,000 credits/month, two scenarios, 5 MB maximum file on Free | File limit is below Atlas's accepted 10 MiB; exclude as the general API layer |
| n8n Cloud | Hosted trial, not established ongoing free hosting | Poor fit as Atlas's primary synchronous API layer; its automation engine must not take Camunda's role |
| Apache Camel on selected compute | Free open-source runtime; hosting is separate | Stronger integration-framework alternative, especially for connector/protocol learning; can run locally or on the backend cloud host |
Azure sources: pricing, Microsoft's monthly allowance description. The Consumption gateway supports JWT validation and send-request, but lacks some higher-tier networking, caching and policy capabilities. It cannot reach Mac-local services without connectivity. Validate upload streaming, policy limits and total charges before selection.
Primary-source details for the other hosted platforms are in hosted integration research. Programmable API research covers Workers, Azure and Apache Camel.
If avoiding Mac exposure is the main goal
An entirely local API integration service alongside the existing Docker stack is simpler than replacing CloudHub with another hosted service. Use Camel if integration patterns/connectors are a learning objective, or a small TypeScript service for this REST-only prototype. All service-to-service calls stay local and Contentful can be accessed through outbound release imports. This returns to the local deployment model; it is a separate choice from keeping only the UI local.
If the owner still wants all backend services off the Mac and fewer cloud providers, deploy that same integration service on the backend's cloud VM. Software can be free, but the VM must independently qualify for an adequate free allowance. Workers is useful when a separately managed free API runtime is desired; it is not mandatory in front of a backend host that can also run the API layer.
Preserve the accepted contracts
Maintain distinct Experience and System API contracts, Keycloak authorization and service identity, and owner-side permissions. Return 202 only after the business owner durably records acceptance. Keep idempotency, revisions, outbox delivery and receipts in their authoritative backend modules. Camunda remains the BPMN engine. A gateway cache, automation run or Worker completion cannot stand in for these guarantees.
Required proof for a selected replacement includes JWT/JWKS rotation and denial, cross-employer access, current-session checks, request mapping, 10 MiB authenticated document streaming, durable-acceptance response loss, duplicate replay, dependency outage, quota exhaustion and resource measurements. Agents can operate Workers with Wrangler, Azure through its Resource Manager tooling, or Camel through versioned builds and container deployment. All options still require scoped credentials and reviewable configuration.
On owner selection, supersede ADR 0007, update the vendor-specific wording in the API contract and runtime proposals, and replace the Anypoint deployment plan. Preserve the behavioral decisions in ADR 0005. No replacement was deployed, no account created, and no accepted ADR changed during this research.