Self-host GitProxy
v2.3.0Git push proxy with custom security policies
- Stars
- 262
- Ports
- 8000 (Git proxy HTTP server), 8443 (Git proxy HTTPS server), 8080 (UI/API HTTP server), 8444 (UI/API HTTPS server), 2222 (SSH proxy server)
finos/git-proxyWhat is GitProxy?
GitProxy is a self-hosted tool that sits between developers and Git servers like GitHub or GitLab to enforce custom push rules. Every push gets checked by a configurable pipeline — scanning for secrets with gitleaks, validating commit messages and author emails, detecting hidden commits, and running pre-receive hooks — before the push is either blocked or allowed through. It works the same way over both HTTP/HTTPS and SSH, with SSH agent forwarding keeping private keys on the developer's machine. You can install it via npm, run the Docker image from Docker Hub, or build from source. The web UI supports local accounts, ActiveDirectory/LDAP, and OpenID Connect for login. Data can be stored in an embedded file database (NeDB), MongoDB, or PostgreSQL. The project comes from the FINOS foundation and aims at regulated sectors like finance that need standard git workflows with compliance controls.
Should you self-host GitProxy?
GitProxy scores 52/100 on selfhost.directory (how scoring works) and ranks #39 of 78 in Security. It has 262 GitHub stars.
It shipped 8 stable releases in the past year. The latest, v2.3.0, came out on 17 October 2026.
Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is Apache-2.0-licensed and written mostly in Typescript.
Its closest alternative on selfhost.directory is pentagi (83/100, 32 629 stars). It scores higher overall, so compare the two before you pick. See GitProxy vs pentagi side by side.
Features
- Attestation workflow
- Audit Logging
- Author email validation
- Commit message validation
- Dynamic configuration reload
- Hidden commit detection
- HTTP/HTTPS proxy
- Multiple Authentication Methods
- Plugin System
- Pre-receive hooks
- Secret Detection
- SSH proxy
- Upstream proxy support
- Web Dashboard
GitProxy README
More in Security
GlobaLeaksGlobaLeaks is a free, open-source, self-hosted whistleblowing platform for secure anonymous reporting with Tor, HTTPS, 2FA, and regulatory compliance.
gluetunVPN client in a thin Docker container for multiple VPN providers, written in Go, and using OpenVPN or Wireguard, DNS over TLS, with a few proxy servers built-in.- GNUnetGNUnet is a framework for secure, decentralized, and privacy-preserving peer-to-peer networking. It aims to replace the insecure Internet protocol stack with a robust, censorship-resistant network.
grafeasGrafeas is an open-source, self-hosted artifact metadata API for auditing software supply chains by storing and querying metadata about container images.
guardian-walletA self-hosted wallet for AI agents that uses threshold cryptography to split keys into three shares, with policy controls and developer SDKs.
GUSTGUST is a self-hosted, open-source web proxy running as a single HTML file in any browser, using WebAssembly and WISP tunneling to bypass filters without Service Workers.
HarborHarbor is an open-source, self-hosted container registry providing vulnerability scanning, image signing, and role-based access control for Kubernetes and Docker.
headscaleSelf-hosted, open-source Tailscale control server for personal and small org tailnets with WireGuard VPN, MagicDNS, and ACLs.
Hermes-Secure-Email-GatewaySelf-hosted email security gateway and mail server with spam filtering, encryption, DKIM/DMARC/ARC, Dovecot mailboxes, Nextcloud, and Authelia SSO in one Docker stack.
hettyAn HTTP toolkit for security research.
hiveboxSelf-hosted Linux sandbox isolating AI agents with kernel namespaces and cgroups, featuring a REST API, MCP bridge, and built-in web dashboard.
homesocSelf-hosted, open-source SOC dashboard for home networks that unifies Wazuh alerts, AdGuard DNS logs, and CVE tracking with AI-powered alert explanations via Claude CLI.
0 comments