KHUBStop paying six different
companies for your dev stack.
KHUB replaces GitHub, Gitea, Codeberg, and Forgejo for your code, Slack for your team chat, and Jira for your issues and boards. Real Git repos, pull requests, a visual CI/CD pipeline editor, wikis, releases, and WebRTC calls, all in one self-hosted platform running on hardware you actually control.
Everything a dev team needs. Nothing you have to stitch together.
One platform, one deployment, one permission model — from your first commit to a production release.
CI/CD that actually runs your code
A visual, node-based pipeline editor that stays in sync with your YAML. Every job runs in an ephemeral, capability-dropped Docker container — real execution, not a simulation. Ships with 50+ starter templates across languages, frameworks, and infrastructure.
Chat, with real calls
Org and repo channels, categories, and DMs delivered over WebSocket — no polling. Voice channels support genuine peer-to-peer WebRTC audio, video, and screen share.
Real Git. Both transports.
Bare repositories on disk with real SHAs and parent chains — git fsck-able outside the app. Clone over HTTP smart protocol or a dedicated SSH daemon authenticated by key.
Pull requests, done right
Threaded inline review, approve / request-changes / comment states, CODEOWNERS auto-requests, and branch protection enforced server-side — not just hidden in the UI.
Issues & Kanban boards
Labels, milestones, priorities, and project-wide views across every repository, plus Kanban boards scoped to the project.
Wiki & releases
A Markdown wiki per project, plus tagged releases with draft/prerelease states and binary asset uploads.
Orgs, projects & teams
A three-level hierarchy with public/internal/private visibility, granular roles at every level, team-scoped grants, and an admin audit log.
Security-first accounts
Argon2 password hashing, TOTP two-factor auth, personal access tokens, SSH keys, and a session list you can revoke from anywhere.
Search, palette & webhooks
Global search across users, code, and commits; a keyboard-driven command palette; SSRF-hardened webhooks with delivery logs.
Build pipelines visually. Ship them the same way, from a YAML file.
The node editor and your .khub-ci.yml stay in sync — build the graph with your mouse, or hand-edit the config; either way the pipeline runs identically. Every job is scheduled into its own ephemeral, isolated container on your own hardware.
- Matrix builds — Fan one job across versions/platforms into real, independently-scheduled jobs.
- Approval gates — Tie a job to an environment with required reviewers; enforced server-side, can't be bypassed by retrying.
- Secrets & environments — Org- or repo-scoped, encrypted at rest, masked out of logs automatically.
- Artifacts — Produced by one job, consumed by the next, downloadable from the run.
- Cron triggers — Schedule pipelines alongside push-triggered runs.
Lightweight enough for one box. Built to scale past it.
Five containers, one ./scripts/deploy.sh. Every push is real Git — no simulated model of a repository sitting behind it.
One authorization resolver
REST API, Git-over-HTTP, Git-over-SSH, and merge-time branch protection all go through the same permission resolver — no path enforces a different rule than the others.
Docker-outside-of-Docker CI
The runner is a separate process from the API. It never executes a CI script itself — it only ever schedules ephemeral containers on the host daemon and streams their output back.
Production-ready primitives
/healthz and /readyz endpoints plus structured logging are already in place for systemd, Nomad, or Kubernetes if you outgrow Compose.
Built for teams who can't put source code in someone else's cloud.
Internal engineering orgs, regulated industries, and agencies running client work — self-hosting means your code, your CI secrets, and your audit trail never leave your network.
Isolated CI execution
Every pipeline job runs in its own ephemeral, capability-dropped container — one job never shares state with another.
Encrypted secrets
CI/CD secrets are encrypted at rest and automatically masked out of any persisted log output.
Argon2 + two-factor auth
Passwords are hashed with argon2, never logged in plaintext. TOTP two-factor auth locks out repeated failed codes.
Full audit log
Org owners and admins can review every administrative action — who did what, to which resource, and when.
SSRF-hardened webhooks
Outbound webhook targets are re-resolved and checked against internal/link-local ranges before every delivery.
Branch & tag protection
Required approvals, status checks, and CODEOWNERS review are enforced server-side at push and merge time — not just hidden in the UI.
No per-seat pricing. No third party holding your source code.
Hosted SaaS platforms
- Per-seat billing that scales with headcount
- Source code and CI secrets live on someone else's infrastructure
- CI minutes metered and rate-limited
- Data residency decided by the vendor
Self-hosted
- One Docker Compose stack — unlimited users, unlimited repos
- Everything runs on hardware you control
- CI capacity is whatever compute you give the runner
- Your network, your retention policy, your backups
Why this actually exists
Hey, I'm Georgios. Most people just know me as kernelstub.
A while back I spent months reverse engineering Flock Safety's ALPR camera network. I mapped out where the cameras actually were, pulled apart the hardware, and wrote up everything I found wrong with it. I posted that research on GitHub. Not long after, GitHub banned my account for it. No real warning, and no appeal that went anywhere.
That sat wrong with me. My work, gone, because one company didn't like what I found. I didn't want to depend on a platform that could delete years of work over a complaint, so I decided to just build my own.
KHUB is the same workflow you already know, repos, pull requests, issues, CI, wikis, chat, running on a box you actually control. Nobody can ban you from your own server.
This project exists because I got tired of asking permission to keep my own work online. I hope it means you never have to either.
Deploy in under two minutes.
If you have Docker, you have everything KHUB needs.
Requirements
- Docker Engine 24+
- Docker Compose v2
- openssl (already on basically every box, used to generate your secrets)
Your own box, no domain needed. Just runs at localhost:8080.
# 1. grab the release and unzip it$unzip khub.zip && cd khub# 2. deploy in self-hosted mode$./scripts/deploy.sh --self
The script generates real random secrets on first run and never overwrites an existing .env. For a real domain, just add --domain=yourdomain.com and Caddy handles TLS on its own.