Self-host github-release-monitor with Docker

Name: github-release-monitor
Availability: InStock
Author: iamspido

GitHub

Install

Updated10 hours ago

LanguageTypescript

Setup difficultyModerate

MobileResponsive

ThemeDark mode

Stars: 438
Port: 3000 (Application server)

Docker

ghcr.io/iamspido/github-release-monitor

Install with Docker

What is github-release-monitor?

GitHub Release Monitor is a self-hosted application that automatically tracks releases from multiple forge platforms including GitHub, GitLab, Codeberg, and self-hosted Forgejo instances. It delivers instant notifications via SMTP email or Apprise integration to over 70 notification services like Discord, Telegram, and Slack. The app includes automated background checking, flexible filtering rules with regex support, dark mode UI, multi-language support in 19 languages, and secure authentication with passkey capability. Users can import/export monitored repositories as JSON and verify configurations using built-in diagnostic tools.

Should you self-host github-release-monitor?

github-release-monitor scores 52/100 on selfhost.directory (how scoring works) and ranks #69 of 166 in Developer Tools. It has 438 GitHub stars.

It shipped 9 stable releases in the past year. The latest, v2.6.0, came out on 26 August 2026. New versions land roughly every 2 weeks.

Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is Other-licensed and written mostly in Typescript.

Its closest alternative on selfhost.directory is openhands (87/100, 92 086 stars). It scores higher overall, so compare the two before you pick. See github-release-monitor vs openhands side by side.

How to configure github-release-monitor

ALLOWED_DEV_ORIGINSComma-separated list of allowed origins in development; blocks others in middleware.
Comma-separated list of allowed origins in development; blocks others in middleware.
APPRISE_URLURL of your Apprise service's notification endpoint (e.g., http://host/notify or http://host/notify/key).
URL of your Apprise service's notification endpoint (e.g., http://host/notify or http://host/notify/key).
AUTH_ENABLE_PASSKEYtrueEnables WebAuthn passkey features when set to `true`.
Enables WebAuthn passkey features when set to `true`.
AUTH_ENABLE_SIGNUPfalseEnables self-service signup when set to `true`. Keep `false` for single-user mode.
Enables self-service signup when set to `true`. Keep `false` for single-user mode.
AUTHENTICATION_METHODBasicAuthentication mode: `Basic`, `AllowUnauthenticated`, or `External`. `External` should only be used behind another auth layer.
Authentication mode: `Basic`, `AllowUnauthenticated`, or `External`. `External` should only be used behind another auth layer.
AUTH_GITHUB_CLIENT_IDOAuth client ID for GitHub social login.
OAuth client ID for GitHub social login.
AUTH_GITHUB_CLIENT_SECRETOAuth client secret for GitHub social login.
OAuth client secret for GitHub social login.
AUTH_GOOGLE_CLIENT_IDOAuth client ID for Google social login.
OAuth client ID for Google social login.
AUTH_GOOGLE_CLIENT_SECRETOAuth client secret for Google social login.
OAuth client secret for Google social login.
AUTH_LOGIN_LOCKOUT_SECONDS900Lockout duration (seconds) after too many failed login attempts.
Lockout duration (seconds) after too many failed login attempts.
AUTH_LOGIN_WINDOW_SECONDS900Time window (seconds) used to count failed login attempts.
Time window (seconds) used to count failed login attempts.
AUTH_MAX_LOGIN_ATTEMPTS5Maximum failed login attempts before a temporary lockout is applied.
Maximum failed login attempts before a temporary lockout is applied.
AUTH_PASSWORD_RESET_TOKEN_TTL_SECONDS900Lifetime of single-use password reset links in seconds (60-86400).
Lifetime of single-use password reset links in seconds (60-86400).
AUTH_SECRETBackward-compatible fallback for `BETTER_AUTH_SECRET`.
Backward-compatible fallback for `BETTER_AUTH_SECRET`.
AUTH_SETUP_TOKENOne-time setup token used to create the first user when no users exist yet.
One-time setup token used to create the first user when no users exist yet.
AUTH_TRUSTED_PROXY_HOPS1Number of trusted proxy entries counted from the right side of `X-Forwarded-For` (1-10).
Number of trusted proxy entries counted from the right side of `X-Forwarded-For` (1-10).
AUTH_TRUST_PROXY_HEADERStrue (2.x compatibility; explicit true required for reset IP limits)Trusts `X-Forwarded-For`/`X-Real-IP` for per-client login limits and, only when explicitly `true`, password-reset IP limits. Without explicit trust, password resets use a hashed account-identifier limit instead. Set to `true` only behind a proxy that overwrites these headers; use `false` for direct exposure. Version 2.x preserves the general trusted-header behavior when unset; the next major will
Trusts `X-Forwarded-For`/`X-Real-IP` for per-client login limits and, only when explicitly `true`, password-reset IP limits. Without explicit trust, password resets use a hashed account-identifier limit instead. Set to `true` only behind a proxy that overwrites these headers; use `false` for direct exposure. Version 2.x preserves the general trusted-header behavior when unset; the next major will
AUTH_TRUST_SOCIAL_LINKINGtrueTrusts configured social providers for automatic account linking by email (`github`, `google`).
Trusts configured social providers for automatic account linking by email (`github`, `google`).
BETTER_AUTH_SECRETBetter Auth secret key (minimum 32 characters).
Better Auth secret key (minimum 32 characters).
BETTER_AUTH_URLBase URL used by Better Auth (e.g. `http://localhost:3000`).
Base URL used by Better Auth (e.g. `http://localhost:3000`).
CODEBERG_ACCESS_TOKENA Codeberg access token (Gitea API) for private repos. Typically needs `read:repository`; `read:user` only for diagnostics.
A Codeberg access token (Gitea API) for private repos. Typically needs `read:repository`; `read:user` only for diagnostics.
FORGEJO_ACCESS_TOKENSBase-URL-based Forgejo tokens as comma-separated `base-url=token` pairs for private repos.
Base-URL-based Forgejo tokens as comma-separated `base-url=token` pairs for private repos.
FORGEJO_ADDITIONAL_BASE_URLSAllowed self-hosted Forgejo base URLs, comma-separated. Supports HTTP/HTTPS, ports, and subpaths.
Allowed self-hosted Forgejo base URLs, comma-separated. Supports HTTP/HTTPS, ports, and subpaths.
GITHUB_ACCESS_TOKENA GitHub Personal Access Token to increase the API rate limit. A token with no scopes is sufficient.
A GitHub Personal Access Token to increase the API rate limit. A token with no scopes is sufficient.
GITLAB_ACCESS_TOKENSHost-based GitLab tokens as comma-separated `host=token` pairs for private repos.
Host-based GitLab tokens as comma-separated `host=token` pairs for private repos.
GITLAB_ADDITIONAL_HOSTSAdditional GitLab hosts (without schema/port), comma-separated. `gitlab.com` is always allowed.
Additional GitLab hosts (without schema/port), comma-separated. `gitlab.com` is always allowed.
GITLAB_DEPLOY_TOKENSHost-based GitLab deploy tokens as comma-separated `host=username:token` pairs for private repos.
Host-based GitLab deploy tokens as comma-separated `host=username:token` pairs for private repos.
HTTPStrueSet to `false` to run in HTTP mode. Defaults to `true` for secure operation.
Set to `false` to run in HTTP mode. Defaults to `true` for secure operation.
LOG_LEVELwarn (prod), debug (dev)Controls server log verbosity: `error`, `warn`, `info`, `debug`, `silent`.
Controls server log verbosity: `error`, `warn`, `info`, `debug`, `silent`.
MAIL_FROM_ADDRESSThe email address that notifications will be sent from.
The email address that notifications will be sent from.
MAIL_FROM_NAMEGitHub Release MonitorThe display name for the "from" address.
The display name for the "from" address.
MAIL_HOSTThe hostname or IP address of your SMTP server.
The hostname or IP address of your SMTP server.
MAIL_PASSWORDThe password or app token for SMTP authentication.
The password or app token for SMTP authentication.
MAIL_PORTThe port for your SMTP server (e.g., 587 or 465).
The port for your SMTP server (e.g., 587 or 465).
MAIL_TLS_REJECT_UNAUTHORIZEDtrueVerifies SMTP TLS certificates. Only `false` disables verification for invalid or self-signed certificates.
Verifies SMTP TLS certificates. Only `false` disables verification for invalid or self-signed certificates.
MAIL_TO_ADDRESSThe email address that will receive the notifications.
The email address that will receive the notifications.
MAIL_USERNAMEThe username for SMTP authentication.
The username for SMTP authentication.
TZSystem defaultServer timezone for schedules, logs, emails, and background notifications. UI timestamps use the browser timezone.
Server timezone for schedules, logs, emails, and background notifications. UI timestamps use the browser timezone.