Introduction
iForge is a task-driven, lightweight, self-hosted Git service platform that deeply integrates project management with code development.
Core Philosophy
Most Git platforms treat "code hosting" and "project management" as two separate modules—you manage tasks in Jira and code in GitHub/GitLab, maintaining the connection manually.
iForge's core design philosophy is task-driven development—enabling project management and code development to work together in a single system, where every code change is traceable to business requirements:
Requirements → Break down into Stories → Link to Git branches → Commit code → Create MR → Merge → Task automatically completed
Core Workflow
Here's a typical iForge development workflow:
┌─────────────────────────────────────────────────────────────────┐
│ 1. Product manager creates requirements on the board, │
│ breaks them down into Stories and Tasks │
│ ── TASK-12: Fix user login timeout issue │
│ │
│ 2. Developer creates a development branch from the task card │
│ (automatically bound to the task) │
│ └── task-12-fix-login-timeout │
│ │
│ 3. Commit code normally, no need to write task number │
│ └── git commit -m "Optimize database queries" │
│ │
│ 4. Create merge request, automatically linked to task │
│ └── MR-45: Fix login timeout → linked to TASK-12 │
│ │
│ 5. Code review passed, task status automatically updated │
│ after merge │
│ └── TASK-12 status: In Progress → Completed │
└─────────────────────────────────────────────────────────────────┘
Core Difference
Branches are bound to tasks when created. You don't need to write task numbers in commit messages. All changes are automatically attributed to the task timeline.
Four Core Features
| Feature | Description | Traditional Platforms |
|---|---|---|
| 🔗 Branch as Task | One-click create development branches from task cards, automatically binding tasks and branches | Manually create branches, disconnected from task system |
| 📝 Commit as Record | Commit normally, all changes automatically attributed to task timeline, no need to write task numbers | Need to manually reference task numbers in commit messages |
| 🔀 MR as Delivery | Merge requests linked to tasks, task status automatically updated after merge | Need to manually update task status after merge |
| 📊 Board as Panorama | Drag tasks on the board, real-time reflection of development progress | Need to switch between multiple systems to check progress |
Core Capabilities
| Module | Description |
|---|---|
| Task-Code Linkage | Task ↔ Branch ↔ Commit ↔ MR full-chain association, bidirectional traceability |
| Code Hosting | Git HTTP/SSH protocols, public/private repositories, branch protection, file browsing, commit history |
| Agile Project Management | Full Scrum chain: Epic → User Story → Sprint → Task board, AI-assisted breakdown |
| Collaboration | Issue tracking, Merge Requests (MR), Wiki, comment system, @mention notifications, real-time WebSocket push |
| CI/CD | Built-in Pipeline/Job/Runner, .iforge-ci.yml declarative pipeline, Docker sandbox isolation |
| Authentication & Permissions | Local accounts, LDAP, OIDC single sign-on, organizations/teams, SSH keys, access tokens |
| Extensions | Plugin system, Webhooks, mirror synchronization, Release management |
Security Features
iForge has undergone deep security hardening, benchmarking against world-class open-source project standards:
| Feature | Description |
|---|---|
| Git Input Validation | All branch names, tag names, and file paths are strictly validated to prevent command injection and path traversal attacks |
| Docker Sandbox Isolation | CI/CD Job containers have network disabled by default (--network=none), limited to 2GB memory, 2 CPU cores, 256 processes |
| Shell Executor Disabled by Default | Production environment uses Docker Executor by default, preventing direct execution of user code on the host |
| Repository-Level Concurrency Locks | All Git write operations ensure concurrency safety through repository-level mutex locks |
| Runner Permission Isolation | External Runners can only execute Jobs for repositories they have permission for, supporting global/user/repository three-level scope |
| Working Directory Auto-Cleanup | Working directories are automatically cleaned up after Job execution to prevent disk space exhaustion |
| Secure Encryption Key Generation | Uses database transactions + row-level locks to prevent concurrent race conditions leading to key inconsistency |
Tech Stack
Backend
- Framework: Go + Fiber v2
- Database: SQLite (default) / MySQL / PostgreSQL
- Git Implementation: go-git
- Authentication: JWT + Session Cookie
Frontend
- Framework: Next.js 16 + React 19
- UI Library: Chakra UI
- Styling: Emotion + Framer Motion
- Virtual Scrolling: @tanstack/react-virtual
Project Structure
iforge/
├── server/ # Backend service (Go/Fiber)
│ ├── cmd/server/ # Service entry
│ ├── internal/
│ │ ├── handler/ # HTTP handlers
│ │ ├── service/ # Business logic
│ │ ├── model/ # Data models
│ │ ├── middleware/ # Middleware
│ │ ├── router/ # Route definitions
│ │ ├── git/ # Git operation encapsulation (with input validation, repository locks)
│ │ └── container/ # Dependency injection container
│ └── data/ # Data directory (generated at runtime)
│
├── web/ # Frontend application (Next.js 16)
│ └── src/
│ ├── app/ # Next.js pages
│ ├── components/ # React components
│ ├── contexts/ # React Context (authentication, WebSocket, i18n)
│ └── lib/ # Utility functions, API client
│
├── docker-compose.yml # Docker deployment orchestration (supports SQLite/MySQL/PostgreSQL)
└── .env.example # Environment variable example
Related Repositories
| Repository | Description |
|---|---|
| iforge | Main platform (server + web) |
| iforge-site | Official documentation site (Docusaurus) |
| iforge-runner | CI/CD executor (deployed independently) |
| iforge-nginx | Nginx reverse proxy configuration (unified domain routing management) |
License
Apache License 2.0 + additional conditions — see LICENSE for details.
- ✅ Allows commercial use, secondary development, enterprise delivery
- ❌ Must not operate multi-tenant SaaS services based on the source code
- ❌ Must not remove the LOGO and copyright information in the console
Ready? Go to Quick Start or Docker Deployment.