# shithub v0.1.0

shithub is now live at **shithub.sh**.

A self-hostable git forge that aims to look and feel like GitHub.
AGPL-licensed, written in Go, no AI training on your code, no
Copilot.

You can [sign up](https://shithub.sh/signup) to host code on
the hosted instance, or
[stand one up yourself](https://docs.shithub.sh/self-host/deploy.html)
from the source.

The project's own source is now hosted on shithub at
[shithub.sh/shithub/shithub](https://shithub.sh/shithub/shithub).
A one-way mirror keeps pushing to the original GitHub repo for the
first 90 days as a recovery surface; after that, the canonical home
is the self-hosted instance.

## What works today

The forge loop works end-to-end:

- **Identity** — signup, email verification, password reset, TOTP
  2FA + recovery codes, SSH keys, scoped personal access tokens,
  sessions with per-account "sign out everywhere."
- **Repos** — create, fork, archive, transfer, soft-delete with
  grace, rename with redirects, visibility toggles, branch
  protection (force-push / deletion / required reviews / required
  status checks), default-branch swap, topics, README/license/
  .gitignore templates.
- **Git** — bare repos on disk, HTTPS smart-HTTP push/pull,
  pre/post-receive hook integration for size accounting and event
  emission.
- **Code browsing** — tree, blob with chroma syntax highlighting
  (light/dark themes), raw, blame, commit history, individual
  commit views, branch/tag listings, compare views, file finder.
- **Issues + PRs** — full CRUD on issues + comments + labels +
  milestones + assignees; pull requests with diff rendering,
  file-by-file review, line comments, reviews, required-reviewer
  enforcement, status-check gates, three merge methods.
- **Social** — stars, watches with notification level, forks
  (clone-on-create), `/explore`, stargazer/watcher lists.
- **Search** — code, repos, users, issues — with the operators
  you'd expect.
- **Notifications** — in-app inbox, email fan-out, watch-level
  routing, one-click HMAC-signed unsubscribe.
- **Orgs + teams** — create, member roles, invitations, one-level
  team nesting, team grants on repos with max-of-sources policy.
- **Webhooks** — outbound delivery with HMAC-SHA256 signing,
  exponential backoff with jitter, auto-disable on persistent
  failure, SSRF defense, redelivery UI, ping events.

## What's not there yet

Honesty over hype:

- **SSH git transport** — HTTPS works; the SSH front-end is
  planned. Use HTTPS clone URLs for now.
- **Actions / CI** — there is no CI runner. Status checks are
  wired into PR gates so a future runner can publish into them.
- **Packages / Releases / Pages / Projects / Gists** — none of
  these surfaces exist yet.
- **GraphQL API** — only a small REST surface today
  (`/api/v1/user`, check-runs, stars). The shape for the rest is
  documented and will land incrementally.
- **Activity feed** — domain events are recorded; the
  user-facing feed isn't built yet.
- **Mobile app** — nothing native. The web works on small
  viewports but isn't pixel-tuned for them.
- **Visual polish** — most pages render correctly but don't look
  like GitHub yet. Spacing, typography, octicon coverage,
  focus-state details — all still drifting.

The full roadmap is in
[`.docs/sprints/`](https://shithub.sh/shithub/shithub/tree/trunk/.docs/sprints)
on the source repo.

## Why

GitHub is a well-built platform. Microsoft's Copilot push has
changed its character — particularly around how user code is
treated as training data. shithub recreates the parts that worked
on terms that make a self-hosted instance an honest equal to the
SaaS experience, with AGPLv3 keeping any hosted variant open.

The 1:1 goal is intentional. There are plenty of git forges with
their own UX vision; shithub deliberately doesn't try to be one
of them. The closer the muscle-memory match, the lower the cost
of switching.

## Self-hosting

If you'd rather run your own instance, the operator docs are at
[docs.shithub.sh/self-host](https://docs.shithub.sh/self-host/prerequisites.html).
Reference target is one DigitalOcean droplet, Postgres on a
second, DigitalOcean Spaces for object storage, Caddy at the
edge. The Ansible playbook in `deploy/ansible/` is the install
path; expect ~45 min from a fresh Ubuntu 24.04 droplet to
"signup form open."

## Security

If you find a vulnerability, please email
**security@shithub.sh** before disclosing publicly. Auto-ack
within minutes; a human response within 72 hours. Full policy at
[SECURITY.md](https://shithub.sh/shithub/shithub/blob/trunk/SECURITY.md).

## On call

The author is on call for the first month. Expect rough edges;
we're triaging publicly. Issue tracker for shithub itself lives
on shithub itself:
[shithub.sh/shithub/shithub/issues](https://shithub.sh/shithub/shithub/issues).

## Thanks

To everyone who pushed the AI-free git forge conversation forward.
This is one more option; the more, the better.

— the author