flagon-io/g1t

public

1	---
2	title: An open letter to Cloudflare
3	description: From the team at Flagon, Inc. building g1t, a git platform that runs entirely on Cloudflare. What works, where we hit walls, and what we'd ask for.
4	---
5
6	Dear Cloudflare,
7
8	We're the small team at Flagon, Inc. building g1t, a git platform where
9	people and coding agents work in the same issues, pull requests and merge
10	queue. Every part of it runs on you: about twenty Workers, a D1 database per
11	service, Artifacts for every repository and every pull request, Containers
12	for agents and CI, R2, KV, Queues, and Cloudflare for SaaS for our customers'
13	domains. We have no servers.
14
15	This is a thank-you, and a list of what would help us most next.
16
17	## Why we built on you
18
19	A git platform is usually a fleet: storage nodes, a job system, a database
20	cluster, a CDN in front, and people on call for all of it. We wanted to run
21	one for thousands of teams with a handful of people. You offered a global
22	platform where the unit of work is a request, the unit of storage is a
23	Durable Object, and nothing costs money while nobody is using it.
24
25	Artifacts is the reason g1t exists in this shape. One Durable Object per
26	repository is the right isolation unit: a busy repository doesn't slow its
27	neighbours, and there is nothing to shard by hand. It speaks real git, so
28	stock clients cloned, fetched and pushed through our proxy from the first
29	day. `fork()` is a single call, and per-pull-request isolation for agents
30	fell out of it almost for free. Scoped tokens that expire on their own let
31	us hand a sandbox a credential that dies with it. The read binding powers
32	every page we render, blame, mergeability and search, without a git client
33	anywhere.
34
35	The rest of the platform held up too. Rust compiled to WebAssembly runs our
36	services. D1's read replication is free and good. Containers gave us
37	sandboxes in three sizes. With a cached credential and ref listing, a
38	`git fetch` with nothing new answers in under half a second, and most of
39	our pages answer in under 250 ms. We went from an empty repository to a
40	launch on this stack, and most of it worked the first time.
41
42	## Where we hit walls
43
44	Running a real platform for many teams found the edges. None of these
45	stopped us. Each one costs us code, latency or certainty, and each one will
46	cost the next team building on you the same.
47
48	What a billable operation is. Artifacts pricing names "repo operations,
49	such as create, push, pull, and clone", and the metrics list a different set
50	of event names. Neither says whether binding reads, token mints or ref
51	listings count. We price from cost, so this decides what our customers pay.
52	Depending on the answer, our model for a few thousand workspaces lands
53	anywhere between about $1.8k and $31k a month. Today we count every clone,
54	fetch and push ourselves, and hope it matches.
55
56	What a fork stores. Forks are the natural primitive for a pull request,
57	and agents open pull requests by the thousand. We can't find whether a fork
58	shares objects with its source or copies them. If it copies, an agent-heavy
59	account reaches the 1 TB account limit in days, and at that point every push
60	in the account fails, for every customer at once. We keep forks for now,
61	and are measuring it ourselves.
62
63	A write path and a pre-receive hook. The binding reads, but it can't
64	list refs, move them, or write objects. So to land a pull request we speak
65	git's wire protocol to our own storage from inside a Worker, buffering packs
66	in an isolate with 128 MB to share. With no hook before refs move, branch
67	protection and secret scanning only hold for pushes through our proxy, which
68	parses every pack in WebAssembly before forwarding it. We wrote a second
69	implementation of git's pack format to get there.
70
71	Ref-change events and the cost of a credential. Push events need one
72	subscription per repository, which doesn't scale to tens of thousands of
73	repositories and forks. We record ref changes ourselves, and a test scans
74	our own source to make sure every code path that moves a ref says so. Every
75	git credential takes three binding calls and about 0.8 s to mint, so we
76	cache sealed tokens across isolates in KV.
77
78	Placement that follows data. Smart Placement once ran our site in
79	Amsterdam for a visitor in Denver, while every D1 primary we have is in
80	western North America. Every query crossed the Atlantic, and our Explore
81	page took 0.85 s instead of 0.17 s. We turned placement off everywhere and
82	measure each Worker by hand.
83
84	D1 sessions across service bindings. Read replicas need a bookmark to
85	give read-your-writes. Our site calls seven services, each with its own
86	database, so we built a header protocol to carry bookmarks through service
87	bindings into a cookie and back.
88
89	Containers that build images and keep disks. We found no supported way
90	to run Docker or BuildKit in a Container, so our own CI can't rebuild our
91	sandbox image; that waits for a machine outside. Container disk is
92	ephemeral, so the self-hostable git store we'd like as a warm fallback has
93	to live off Cloudflare.
94
95	Inbound TCP for SSH. Git users expect `git@host:owner/repo`. Workers
96	take no inbound TCP, so g1t is HTTPS only. We've applied for the beta and
97	are waiting.
98
99	## What we built in the meantime
100
101	A per-workspace operation counter that is our best guess at your invoice. A
102	fork sweep we can switch on once we know what forks cost. A smart HTTP
103	client inside a Worker for landing, catch-up, mirrors and imports. Our own
104	push policy in front of Artifacts. A versioned ref cache with a test that
105	guards it. Two layers of credential caching. A bookmark protocol for D1.
106	A probe that deploys throwaway Workers to measure placement, and a
107	`Server-Timing` header on every response so we see the next regression.
108	Image builds on a laptop.
109
110	All of it works. Most of it is code we'd happily delete.
111
112	## What we're asking for
113
114	1. A published definition of a billable Artifacts operation, with
115	per-repository metrics that use the same names as the invoice.
116	2. Documented fork storage, an expiry on `fork()`, a repository's stored
117	bytes in `info()`, and a warning before the account storage limit, with
118	failures per repository rather than account-wide.
119	3. Ref listing, atomic compare-and-swap ref updates and streaming pack
120	writes in the binding.
121	4. A pre-receive hook that a Worker answers.
122	5. Account-level ref-change events to a Queue, a read-after-write guarantee
123	for refs, and git forwarding authenticated by the binding, with no token
124	to mint.
125	6. Placement that accounts for D1 primaries and service bindings, and D1 as
126	a placement target.
127	7. D1 sessions that travel across service bindings.
128	8. Image builds and persistent volumes for Containers.
129	9. Inbound TCP, so git can run over SSH.
130	10. A support path during the beta, snapshot restore and export for
131	repositories, and a date for general availability with an SLA.
132
133	## Let's work on it together
134
135	We chose you on purpose, and we'd choose you again. A small team running a
136	global git platform with no servers is the promise of what you've built,
137	and g1t shows that it mostly holds. We'd like to help close the
138	rest of the gap: traces, test repositories, early builds to try, or a call
139	with the teams involved. Whatever is useful.
140
141	You can reach us through [g1t.sh](https://g1t.sh/support). Our code lives
142	at [g1t.sh/flagon-io/g1t](https://g1t.sh/flagon-io/g1t), on the platform
143	it describes.
144
145	With thanks,
146
147	The team at Flagon, Inc.