Self-Hosted Git Code Hosting System

Engineering & Development

A code hosting service that runs on your own computer: keep Git repositories, open issues and do code review, with the data staying on your own machine. You bring it up with Docker Compose, the database is SQLite, the administrator password is generated at random by a script, and free registration and the version check are both closed. Derived from a frozen snapshot of an open-source project under the MIT licence; the delivery adds a Dockerfile that builds the image from source, a single-service orchestration file, a script that generates the key and password, and a quick-start guide in Traditional Chinese.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-02

In practice

Readiness4 / 5

What you need

Few changes needed4 / 5

Who it is for

Individuals and small teams who want their code, issues and review flow on their own machine, without a cloud hosting service.

How to start

$ sh scripts/quickstart/init-env.sh
$ docker compose up -d

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview2,000+ paths

▸assets4

codemirror-languages.json
favicon.svg
go-licenses.json
logo.svg

▸build10

generate-bindata.go
generate-emoji.go
generate-gitignores.go
generate-go-licenses.go
generate-openapi.go
openapi3gen/
update-locales.sh

▸cmd58

actions.go
admin.go
admin_auth.go
admin_auth_ldap.go
admin_auth_ldap_test.go
admin_auth_oauth.go
admin_auth_oauth_test.go
admin_auth_smtp.go
admin_auth_smtp_test.go
admin_regenerate.go
…

▸contrib13

README
development/
fhs-compliant-script/
grafana-monitoring-mixin/
sample-page/
upgrade.sh

▸custom1

conf/

▸docker3

README.md
manifest.rootless.tmpl
manifest.tmpl

▸docs9

build-setup.md
build-source.md
community-governance.md
development.md
guidelines-backend.md
guidelines-frontend.md
guidelines-refactoring.md
release-management.md
testing.md

▸modelmigration358

base/
migrations.go
migrations_test.go
migrationtest/
v1_10/
v1_11/
v1_12/
v1_13/
v1_14/
v1_15/
…

▸models449

actions/
activities/
admin/
asymkey/
audit/
auth/
avatars/
db/
dbfs/
deploykey/
…

▸modules753

actions/
analyze/
assetfs/
auth/
avatar/
badge/
base/
cache/
cachegroup/
charset/
…

▸options226

fileicon/
gitignore/

▸routers1

init.go

▸snap3

part-gitea-build.sh
part-gitea-pull.sh
snapcraft.yaml

▸templates3

home.tmpl
install.tmpl
post-install.tmpl

▸tests5

mssql.ini.tmpl
mysql.ini.tmpl
pgsql.ini.tmpl
sqlite.ini.tmpl
test_utils.go

▸tools17

build-release.sh
ci-tools.ts
generate-cliffignore.sh
generate-codemirror-languages.ts
generate-images.ts
generate-svg-vscode-extensions.json
generate-svg.ts
gocovmerge.go
lint-go-all.go
lint-shell.sh
…

▫AGENTS.md

▫ATTRIBUTION.md

▫BSDmakefile

▫CODE_OF_CONDUCT.md

▫CONTRIBUTING.md

▫DCO

▫Dockerfile

▫Dockerfile.quickstart

▫Dockerfile.rootless

▫LICENSE

▫LICENSE-99LL.md

▫MAINTAINERS

▫Makefile

▫PRODUCT.md

▫QUICKSTART.md

▫README.md

▫README.zh-cn.md

▫README.zh-tw.md

▫SECURITY.md

▫SECURITY.upstream.md

▫cliff.toml

▫crowdin.yml

▫delivery-manifest.txt

▫docker-compose.yml

▫eslint.config.ts

▫eslint.json.config.ts

▫flake.lock

▫flake.nix

▫go.mod

▫go.sum

▫main.go

▫main_timezones.go

▫package.json

▫playwright.config.ts

▫pnpm-lock.yaml

▫pnpm-workspace.yaml

▫pyproject.toml

▫renovate.json5

▫stylelint.config.ts

▫tailwind.config.ts

▫tsconfig.json

▫types.d.ts

▫uv.lock

▫vite.config.ts

▫vitest.config.ts

▫Config and hidden files 42

Latest passing run

Clone → Checkout → Toolchain → Build images → Admin login and create repo

Pre-purchase Disclosure

What you are buying

A self-hosted Git code hosting system: keep Git repositories, open issues and do code review, with the data staying on your own machine. You bring it up with Docker Compose, the first start creates the administrator automatically, and free registration is closed.

Derived from an open-source project under the MIT licence, and not the original project itself. Our work: a Dockerfile, a single-service orchestration file, a step that creates the administrator, a password generation script and a quick-start guide in Traditional Chinese.

Delivery is a frozen snapshot: one zip, taken from the product repository at revision 7715fb8.

Known limitations

The web and SSH ports are open only on ports 3000 and 2222 of the local machine 127.0.0.1; TLS and opening it to others are yours to bring
No domain, HTTPS certificate, outgoing mail or external sign-in is configured
There is one administrator account, free registration is closed, and other accounts are created by the administrator
The site has Actions built in, but the delivery has no runner to execute jobs
The address the site records internally is http://localhost:3000/, so open it with localhost
The database, repositories and configuration file all live in the Docker named volume gitdata
docker compose down -v deletes all repositories and accounts and cannot be undone
The first start builds the image from source, fetching from registries, the Go module proxy and package repositories during that time
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit 5e4ed4d. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

5 PASS0 WARN0 FAIL

Source ReviewPASS

Execution surface of the delivery reviewed item by item. Our own additions were read: docker-compose.yml (the web port and the SSH port are both bound to 127.0.0.1 only; the database is SQLite in a named volume; it refuses to start when the site key or the internal token is missing; installation is locked, free registration is closed and the version check is closed), scripts/quickstart/bootstrap-admin.sh (the password goes in as an argument and the output holds no password; an existing account is not overwritten, and a marker file prevents creating it twice), scripts/quickstart/init-env.sh (openssl generates random values, .env is mode 600, an existing .env is not overwritten) and Dockerfile.quickstart. The upstream Go and front-end sources were not read file by file; the basis is the MIT licence and container isolation.

Script SafetyPASS

The scripts on the buyer’s delivery path were each inspected: init-env.sh and bootstrap-admin.sh are ours (reviewed); the build goes through Dockerfile.quickstart (read: Go and front end are built in separate stages, apk installs system packages, with no download piped straight into a shell). At start-up the s6 scripts built into upstream’s image manage the services.

RecencyPASS

This product is a frozen snapshot and does not follow upstream: the upstream source is pinned to the main-line revision taken on the day the product repository was created (see the evidence link), and the product repository is that snapshot plus our own commits.

LicensePASS

SPDX:LicenseRef-99LL-Product

Upstream LICENSE was checked (the evidence link points at the file itself at the pinned version and matches the copy inside the product repository): the standard MIT text, copyright holders The Gitea Authors and The Gogs Authors. It allows commercial use, modification, derivative works, redistribution and sale; the duty is to keep the copyright notice and licence text (LICENSE and ATTRIBUTION.md ship in the zip); upstream has no NOTICE file. The decision does not rest on GitHub’s licence field. For the product as a whole the 99LL product licence template is attached: upstream’s LICENSE is kept as it is and LICENSE-99LL.md is added as the sale and liability terms for the part we built, with spdx recorded as LicenseRef-99LL-Product.

Dependency LicensesPASS

This records the declared side, not a scan result: the Go dependencies are declared in go.mod and locked by go.sum, the front end is declared in package.json, and the packages themselves are fetched from their own repositories when the buyer builds; the base images and system packages come from a registry and apk. These dependency trees were not scanned package by package for licences. Upstream has no submodule and no third-party dataset was copied in (see ATTRIBUTION.md).