@@ -0,0 +1,121 @@ |
| 1 | +# shithub v1.0.0 |
| 2 | + |
| 3 | +shithub is now live at **shithub.example**. |
| 4 | + |
| 5 | +A self-hostable git forge that aims to look and feel like GitHub. |
| 6 | +AGPL-licensed, written in Go, no AI training on your code, no |
| 7 | +Copilot. |
| 8 | + |
| 9 | +You can [sign up](https://shithub.example/signup) to host code on |
| 10 | +the hosted instance, or |
| 11 | +[stand one up yourself](https://docs.shithub.example/self-host/deploy.html) |
| 12 | +from the source. |
| 13 | + |
| 14 | +The project's own source is now hosted on shithub at |
| 15 | +[shithub.example/shithub/shithub](https://shithub.example/shithub/shithub). |
| 16 | +A one-way mirror keeps pushing to the original GitHub repo for the |
| 17 | +first 90 days as a recovery surface; after that, the canonical home |
| 18 | +is the self-hosted instance. |
| 19 | + |
| 20 | +## What works today |
| 21 | + |
| 22 | +The forge loop works end-to-end: |
| 23 | + |
| 24 | +- **Identity** — signup, email verification, password reset, TOTP |
| 25 | + 2FA + recovery codes, SSH keys, scoped personal access tokens, |
| 26 | + sessions with per-account "sign out everywhere." |
| 27 | +- **Repos** — create, fork, archive, transfer, soft-delete with |
| 28 | + grace, rename with redirects, visibility toggles, branch |
| 29 | + protection (force-push / deletion / required reviews / required |
| 30 | + status checks), default-branch swap, topics, README/license/ |
| 31 | + .gitignore templates. |
| 32 | +- **Git** — bare repos on disk, HTTPS smart-HTTP push/pull, |
| 33 | + pre/post-receive hook integration for size accounting and event |
| 34 | + emission. |
| 35 | +- **Code browsing** — tree, blob with chroma syntax highlighting |
| 36 | + (light/dark themes), raw, blame, commit history, individual |
| 37 | + commit views, branch/tag listings, compare views, file finder. |
| 38 | +- **Issues + PRs** — full CRUD on issues + comments + labels + |
| 39 | + milestones + assignees; pull requests with diff rendering, |
| 40 | + file-by-file review, line comments, reviews, required-reviewer |
| 41 | + enforcement, status-check gates, three merge methods. |
| 42 | +- **Social** — stars, watches with notification level, forks |
| 43 | + (clone-on-create), `/explore`, stargazer/watcher lists. |
| 44 | +- **Search** — code, repos, users, issues — with the operators |
| 45 | + you'd expect. |
| 46 | +- **Notifications** — in-app inbox, email fan-out, watch-level |
| 47 | + routing, one-click HMAC-signed unsubscribe. |
| 48 | +- **Orgs + teams** — create, member roles, invitations, one-level |
| 49 | + team nesting, team grants on repos with max-of-sources policy. |
| 50 | +- **Webhooks** — outbound delivery with HMAC-SHA256 signing, |
| 51 | + exponential backoff with jitter, auto-disable on persistent |
| 52 | + failure, SSRF defense, redelivery UI, ping events. |
| 53 | + |
| 54 | +## What's not there yet |
| 55 | + |
| 56 | +Honesty over hype: |
| 57 | + |
| 58 | +- **SSH git transport** — HTTPS works; the SSH front-end is |
| 59 | + planned. Use HTTPS clone URLs for now. |
| 60 | +- **Actions / CI** — there is no CI runner. Status checks are |
| 61 | + wired into PR gates so a future runner can publish into them. |
| 62 | +- **Packages / Releases / Pages / Projects / Gists** — none of |
| 63 | + these surfaces exist yet. |
| 64 | +- **GraphQL API** — only a small REST surface today |
| 65 | + (`/api/v1/user`, check-runs, stars). The shape for the rest is |
| 66 | + documented and will land incrementally. |
| 67 | +- **Activity feed** — domain events are recorded; the |
| 68 | + user-facing feed isn't built yet. |
| 69 | +- **Mobile app** — nothing native. The web works on small |
| 70 | + viewports but isn't pixel-tuned for them. |
| 71 | +- **Visual polish** — most pages render correctly but don't look |
| 72 | + like GitHub yet. Spacing, typography, octicon coverage, |
| 73 | + focus-state details — all still drifting. |
| 74 | + |
| 75 | +The full roadmap is in |
| 76 | +[`.docs/sprints/`](https://shithub.example/shithub/shithub/tree/trunk/.docs/sprints) |
| 77 | +on the source repo. |
| 78 | + |
| 79 | +## Why |
| 80 | + |
| 81 | +GitHub is a well-built platform. Microsoft's Copilot push has |
| 82 | +changed its character — particularly around how user code is |
| 83 | +treated as training data. shithub recreates the parts that worked |
| 84 | +on terms that make a self-hosted instance an honest equal to the |
| 85 | +SaaS experience, with AGPLv3 keeping any hosted variant open. |
| 86 | + |
| 87 | +The 1:1 goal is intentional. There are plenty of git forges with |
| 88 | +their own UX vision; shithub deliberately doesn't try to be one |
| 89 | +of them. The closer the muscle-memory match, the lower the cost |
| 90 | +of switching. |
| 91 | + |
| 92 | +## Self-hosting |
| 93 | + |
| 94 | +If you'd rather run your own instance, the operator docs are at |
| 95 | +[docs.shithub.example/self-host](https://docs.shithub.example/self-host/prerequisites.html). |
| 96 | +Reference target is one DigitalOcean droplet, Postgres on a |
| 97 | +second, DigitalOcean Spaces for object storage, Caddy at the |
| 98 | +edge. The Ansible playbook in `deploy/ansible/` is the install |
| 99 | +path; expect ~45 min from a fresh Ubuntu 24.04 droplet to |
| 100 | +"signup form open." |
| 101 | + |
| 102 | +## Security |
| 103 | + |
| 104 | +If you find a vulnerability, please email |
| 105 | +**security@shithub.example** before disclosing publicly. Auto-ack |
| 106 | +within minutes; a human response within 72 hours. Full policy at |
| 107 | +[SECURITY.md](https://shithub.example/shithub/shithub/blob/trunk/SECURITY.md). |
| 108 | + |
| 109 | +## On call |
| 110 | + |
| 111 | +The author is on call for the first month. Expect rough edges; |
| 112 | +we're triaging publicly. Issue tracker for shithub itself lives |
| 113 | +on shithub itself: |
| 114 | +[shithub.example/shithub/shithub/issues](https://shithub.example/shithub/shithub/issues). |
| 115 | + |
| 116 | +## Thanks |
| 117 | + |
| 118 | +To everyone who pushed the AI-free git forge conversation forward. |
| 119 | +This is one more option; the more, the better. |
| 120 | + |
| 121 | +— the author |
