shithub v0.1.0
shithub is now live at shithub.sh.
A self-hostable git forge that aims to look and feel like GitHub. AGPL-licensed, written in Go, no AI training on your code, no Copilot.
You can sign up to host code on the hosted instance, or stand one up yourself from the source.
The project's own source is now hosted on shithub at shithub.sh/shithub/shithub. A one-way mirror keeps pushing to the original GitHub repo for the first 90 days as a recovery surface; after that, the canonical home is the self-hosted instance.
What works today
The forge loop works end-to-end:
- Identity — signup, email verification, password reset, TOTP 2FA + recovery codes, SSH keys, scoped personal access tokens, sessions with per-account "sign out everywhere."
- Repos — create, fork, archive, transfer, soft-delete with grace, rename with redirects, visibility toggles, branch protection (force-push / deletion / required reviews / required status checks), default-branch swap, topics, README/license/ .gitignore templates.
- Git — bare repos on disk, HTTPS smart-HTTP push/pull, pre/post-receive hook integration for size accounting and event emission.
- Code browsing — tree, blob with chroma syntax highlighting (light/dark themes), raw, blame, commit history, individual commit views, branch/tag listings, compare views, file finder.
- Issues + PRs — full CRUD on issues + comments + labels + milestones + assignees; pull requests with diff rendering, file-by-file review, line comments, reviews, required-reviewer enforcement, status-check gates, three merge methods.
- Social — stars, watches with notification level, forks
(clone-on-create),
/explore, stargazer/watcher lists. - Search — code, repos, users, issues — with the operators you'd expect.
- Notifications — in-app inbox, email fan-out, watch-level routing, one-click HMAC-signed unsubscribe.
- Orgs + teams — create, member roles, invitations, one-level team nesting, team grants on repos with max-of-sources policy.
- Webhooks — outbound delivery with HMAC-SHA256 signing, exponential backoff with jitter, auto-disable on persistent failure, SSRF defense, redelivery UI, ping events.
What's not there yet
Honesty over hype:
- SSH git transport — HTTPS works; the SSH front-end is planned. Use HTTPS clone URLs for now.
- Actions / CI — there is no CI runner. Status checks are wired into PR gates so a future runner can publish into them.
- Packages / Releases / Pages / Projects / Gists — none of these surfaces exist yet.
- GraphQL API — only a small REST surface today
(
/api/v1/user, check-runs, stars). The shape for the rest is documented and will land incrementally. - Activity feed — domain events are recorded; the user-facing feed isn't built yet.
- Mobile app — nothing native. The web works on small viewports but isn't pixel-tuned for them.
- Visual polish — most pages render correctly but don't look like GitHub yet. Spacing, typography, octicon coverage, focus-state details — all still drifting.
The full roadmap is in
.docs/sprints/
on the source repo.
Why
GitHub is a well-built platform. Microsoft's Copilot push has changed its character — particularly around how user code is treated as training data. shithub recreates the parts that worked on terms that make a self-hosted instance an honest equal to the SaaS experience, with AGPLv3 keeping any hosted variant open.
The 1:1 goal is intentional. There are plenty of git forges with their own UX vision; shithub deliberately doesn't try to be one of them. The closer the muscle-memory match, the lower the cost of switching.
Self-hosting
If you'd rather run your own instance, the operator docs are at
docs.shithub.sh/self-host.
Reference target is one DigitalOcean droplet, Postgres on a
second, DigitalOcean Spaces for object storage, Caddy at the
edge. The Ansible playbook in deploy/ansible/ is the install
path; expect ~45 min from a fresh Ubuntu 24.04 droplet to
"signup form open."
Security
If you find a vulnerability, please email security@shithub.sh before disclosing publicly. Auto-ack within minutes; a human response within 72 hours. Full policy at SECURITY.md.
On call
The author is on call for the first month. Expect rough edges; we're triaging publicly. Issue tracker for shithub itself lives on shithub itself: shithub.sh/shithub/shithub/issues.
Thanks
To everyone who pushed the AI-free git forge conversation forward. This is one more option; the more, the better.
— the author
View source
| 1 | # shithub v0.1.0 |
| 2 | |
| 3 | shithub is now live at **shithub.sh**. |
| 4 | |
| 5 | A self-hostable git forge that aims to look and feel like GitHub. |
| 6 | AGPL-licensed, written in Go, no AI training on your code, no |
| 7 | Copilot. |
| 8 | |
| 9 | You can [sign up](https://shithub.sh/signup) to host code on |
| 10 | the hosted instance, or |
| 11 | [stand one up yourself](https://docs.shithub.sh/self-host/deploy.html) |
| 12 | from the source. |
| 13 | |
| 14 | The project's own source is now hosted on shithub at |
| 15 | [shithub.sh/shithub/shithub](https://shithub.sh/shithub/shithub). |
| 16 | A one-way mirror keeps pushing to the original GitHub repo for the |
| 17 | first 90 days as a recovery surface; after that, the canonical home |
| 18 | is the self-hosted instance. |
| 19 | |
| 20 | ## What works today |
| 21 | |
| 22 | The forge loop works end-to-end: |
| 23 | |
| 24 | - **Identity** — signup, email verification, password reset, TOTP |
| 25 | 2FA + recovery codes, SSH keys, scoped personal access tokens, |
| 26 | sessions with per-account "sign out everywhere." |
| 27 | - **Repos** — create, fork, archive, transfer, soft-delete with |
| 28 | grace, rename with redirects, visibility toggles, branch |
| 29 | protection (force-push / deletion / required reviews / required |
| 30 | status checks), default-branch swap, topics, README/license/ |
| 31 | .gitignore templates. |
| 32 | - **Git** — bare repos on disk, HTTPS smart-HTTP push/pull, |
| 33 | pre/post-receive hook integration for size accounting and event |
| 34 | emission. |
| 35 | - **Code browsing** — tree, blob with chroma syntax highlighting |
| 36 | (light/dark themes), raw, blame, commit history, individual |
| 37 | commit views, branch/tag listings, compare views, file finder. |
| 38 | - **Issues + PRs** — full CRUD on issues + comments + labels + |
| 39 | milestones + assignees; pull requests with diff rendering, |
| 40 | file-by-file review, line comments, reviews, required-reviewer |
| 41 | enforcement, status-check gates, three merge methods. |
| 42 | - **Social** — stars, watches with notification level, forks |
| 43 | (clone-on-create), `/explore`, stargazer/watcher lists. |
| 44 | - **Search** — code, repos, users, issues — with the operators |
| 45 | you'd expect. |
| 46 | - **Notifications** — in-app inbox, email fan-out, watch-level |
| 47 | routing, one-click HMAC-signed unsubscribe. |
| 48 | - **Orgs + teams** — create, member roles, invitations, one-level |
| 49 | team nesting, team grants on repos with max-of-sources policy. |
| 50 | - **Webhooks** — outbound delivery with HMAC-SHA256 signing, |
| 51 | exponential backoff with jitter, auto-disable on persistent |
| 52 | failure, SSRF defense, redelivery UI, ping events. |
| 53 | |
| 54 | ## What's not there yet |
| 55 | |
| 56 | Honesty over hype: |
| 57 | |
| 58 | - **SSH git transport** — HTTPS works; the SSH front-end is |
| 59 | planned. Use HTTPS clone URLs for now. |
| 60 | - **Actions / CI** — there is no CI runner. Status checks are |
| 61 | wired into PR gates so a future runner can publish into them. |
| 62 | - **Packages / Releases / Pages / Projects / Gists** — none of |
| 63 | these surfaces exist yet. |
| 64 | - **GraphQL API** — only a small REST surface today |
| 65 | (`/api/v1/user`, check-runs, stars). The shape for the rest is |
| 66 | documented and will land incrementally. |
| 67 | - **Activity feed** — domain events are recorded; the |
| 68 | user-facing feed isn't built yet. |
| 69 | - **Mobile app** — nothing native. The web works on small |
| 70 | viewports but isn't pixel-tuned for them. |
| 71 | - **Visual polish** — most pages render correctly but don't look |
| 72 | like GitHub yet. Spacing, typography, octicon coverage, |
| 73 | focus-state details — all still drifting. |
| 74 | |
| 75 | The full roadmap is in |
| 76 | [`.docs/sprints/`](https://shithub.sh/shithub/shithub/tree/trunk/.docs/sprints) |
| 77 | on the source repo. |
| 78 | |
| 79 | ## Why |
| 80 | |
| 81 | GitHub is a well-built platform. Microsoft's Copilot push has |
| 82 | changed its character — particularly around how user code is |
| 83 | treated as training data. shithub recreates the parts that worked |
| 84 | on terms that make a self-hosted instance an honest equal to the |
| 85 | SaaS experience, with AGPLv3 keeping any hosted variant open. |
| 86 | |
| 87 | The 1:1 goal is intentional. There are plenty of git forges with |
| 88 | their own UX vision; shithub deliberately doesn't try to be one |
| 89 | of them. The closer the muscle-memory match, the lower the cost |
| 90 | of switching. |
| 91 | |
| 92 | ## Self-hosting |
| 93 | |
| 94 | If you'd rather run your own instance, the operator docs are at |
| 95 | [docs.shithub.sh/self-host](https://docs.shithub.sh/self-host/prerequisites.html). |
| 96 | Reference target is one DigitalOcean droplet, Postgres on a |
| 97 | second, DigitalOcean Spaces for object storage, Caddy at the |
| 98 | edge. The Ansible playbook in `deploy/ansible/` is the install |
| 99 | path; expect ~45 min from a fresh Ubuntu 24.04 droplet to |
| 100 | "signup form open." |
| 101 | |
| 102 | ## Security |
| 103 | |
| 104 | If you find a vulnerability, please email |
| 105 | **security@shithub.sh** before disclosing publicly. Auto-ack |
| 106 | within minutes; a human response within 72 hours. Full policy at |
| 107 | [SECURITY.md](https://shithub.sh/shithub/shithub/blob/trunk/SECURITY.md). |
| 108 | |
| 109 | ## On call |
| 110 | |
| 111 | The author is on call for the first month. Expect rough edges; |
| 112 | we're triaging publicly. Issue tracker for shithub itself lives |
| 113 | on shithub itself: |
| 114 | [shithub.sh/shithub/shithub/issues](https://shithub.sh/shithub/shithub/issues). |
| 115 | |
| 116 | ## Thanks |
| 117 | |
| 118 | To everyone who pushed the AI-free git forge conversation forward. |
| 119 | This is one more option; the more, the better. |
| 120 | |
| 121 | — the author |