Host repositories with ngit-grasp
ngit-grasp combines a Nostr relay with an authorised Git smart-HTTP server. Run it to provide repository hosting without becoming the source of truth for the repositories it stores.
If you only want to use somebody else's provider, install ngit. You do not need to operate a server.
Choose a deployment
| Environment | Starting point | Why |
|---|---|---|
| Fresh VPS | Docker Compose with Caddy | Short path to persistent storage and TLS |
| NixOS | Flake module | Declarative service and protected credentials |
| Existing Linux host | Hardened systemd unit | Direct binary lifecycle |
| Managed container host | PaaS deployment | Works when persistent volumes and WebSockets are available |
| Development | Nix development shell | Pinned Rust and test dependencies |
The source repository owns the detailed deployment procedures. This site owns the path between products and generates the complete configuration reference.
Container quick start
From a clean ngit-grasp checkout:
bash
cp deploy.env.example .env
# Set NGIT_DOMAIN and point DNS at this host.
docker compose -f compose.yaml -f compose.caddy.yaml up --build -d
scripts/verify-deployment.sh https://git.example.comA running container is not enough. The verification script checks the public WebSocket relay, Git smart HTTP, discovery, storage, and proxy behaviour.
Configure the service
The generated operator reference is the authority for all public commands, environment options, defaults, validation rules, and secret precedence:
It is labelled upcoming because the exporter was added after the currently tagged release. Do not infer missing settings from this overview.
Protect the important boundaries
Identity and secrets
Supply the relay-owner secret through a protected environment or service credential. Do not put it in a command-line argument, Compose file, or committed environment file.
Storage
Back up both relay state and Git object storage. Memory mode is for tests; its Git data is temporary.
Network exposure
Keep the service on loopback when a reverse proxy is the only public entry point. Configure trusted proxy CIDRs explicitly and test WebSocket upgrades as well as ordinary HTTP.
Observability
Prometheus metrics are available below the configured base path. Monitor relay health, Git operations, proactive sync, purgatory, rate limiting, and storage before offering a public service.
Advertise only enabled profiles
GRASP core behaviour is required. Proactive sync, archive, contributor hosting, and private-service behaviour are optional profiles. Advertise only what the deployment actually enables.