Our own git server for Ninoo projects
· Nicrron Engineering
Every Ninoo Builder project now has a private repository on Ninoo Git, a git server we run ourselves. People sign in with their Ninoo account, clone and push from their own computer, and pushes come back into the live app.
The server
Ninoo Git runs Forgejo, an open-source GitHub-style server, on a machine of its own with an encrypted data volume, regular volume snapshots and a nightly backup to storage. Repositories are private, and an account can only be created by signing in with Ninoo.
For that sign-in, the Builder app acts as a small OpenID Connect provider for exactly one client, the git server. People on a project get access to its repository to match their role in the project.
Keeping tokens out of workspaces
A project's workspace pushes its history after every version, but it never holds a general git token. It talks to a per-project proxy on the Builder app with a token that can reach only that project's repository, and the proxy talks to the server.
Pushes come back
A push to main from someone's computer is merged into the live app the same way a branch prompt is, including the model combining clashes. A push to any other branch shows up in the project as a branch you can preview and merge when you're ready. If a workspace starts again on a fresh volume, its history is fetched back from the server.
What surprised us
- 01Fetching history into a repository whose checked-out branch has no commits yet is refused by git unless you say you mean it (--update-head-ok).