flagon-io/g1t

public

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

git agents cloudflare rust forge mcp

Commit

Prettier leaves the two architecture tables the deploy tool's tests read alone

scripts/deploy/deploy.test.mjs finds each unit's row by its exact text, which Prettier's table padding changes.

G1t-Session:: ses_01m57b7r6jew3aqgyfmhw6yah6

syntaqxcommitted 3h agoParentf6b9520Browse files

14	14		it can reach. A test, `npm run test:deploy`, reads every `wrangler.jsonc`
15	15		and fails if this table and the bindings disagree.
16	16
17		−	\| Unit \| Language \| Stage \| What it does \| Owns \| Calls \|
18		−	\| ----------------------- \| ---------- \| ----- \| ------------------------------------------------------------------------------------------------------------------------- \| ------------------------------------------------------------------------------------- \| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ \|
19		−	\| `apps/web` \| TypeScript \| front \| The site on `g1t.sh`: pages, git over HTTPS and the package registries passed to their services, and `g1tusercontent.com` \| The downloads bucket \| `actions`, `artifacts`, `billing`, `chat`, `deployments`, `events`, `identity`, `integrations`, `notify`, `og`, `packages`, `projects`, `repos`, `search`, `security`, `telemetry`, `webhooks`, `work` \|
20		−	\| `apps/api` \| Rust \| edge \| REST, MCP, OAuth, the runner protocol, OTLP ingest, Actions toolkit and OIDC \| Nothing; writes Actions cache and artifact files \| `actions`, `artifacts`, `billing`, `deployments`, `events`, `identity`, `integrations`, `packages`, `projects`, `repos`, `runner`, `search`, `security`, `telemetry`, `webhooks`, `work` \|
21		−	\| `apps/status` \| TypeScript \| edge \| `status.g1t.sh`: probes every minute and keeps incidents \| D1 `g1t-status` \| `billing`, `repos` \|
22		−	\| `apps/sudo` \| TypeScript \| front \| g1t.sh's staff console, behind Cloudflare Access \| Nothing \| `actions`, `billing`, `events`, `identity`, `projects`, `status`, `telemetry` \|
23		−	\| `apps/docs` \| Astro \| front \| `docs.g1t.sh`, these pages \| Nothing \| none \|
24		−	\| `services/identity` \| Rust \| core \| Accounts, sessions, workspaces, members, teams, repository roles, tokens, OAuth, device sign-in, 2FA \| D1 `g1t`, the avatars KV \| `artifacts`, `billing`, `chat`, `events`, `notify`, `projects`, `repos` \|
25		−	\| `services/repos` \| Rust \| core \| Repositories and git: smart HTTP, pre-receive checks, caches, forks, landing merges, releases, backups \| D1 `g1t-repos`, the git store, the git cache KV, the packs and backups buckets \| `billing`, `events`, `identity`, `security`, `work` \|
26		−	\| `services/work` \| Rust \| core \| Work items, pull requests, comments, reviews, labels, milestones, rulesets, checks, statuses, CODEOWNERS, the merge queue \| D1 `g1t-work` \| `actions`, `events`, `identity`, `integrations`, `repos` \|
27		−	\| `services/events` \| Rust \| core \| The event bus and log, the audit log, the inbox \| D1 `g1t-events`, the `g1t-events` queue and its subscriber queues \| `billing`, `identity`, `notify`, `repos`, `work` \|
28		−	\| `services/actions` \| Rust \| core \| Workflows: reading them, triggering runs, planning jobs, secrets, self-hosted runners, logs \| D1 `g1t-actions`; lists and expires the Actions cache bucket \| `billing`, `deployments`, `events`, `identity`, `notify`, `projects`, `repos`, `runner`, `work` \|
29		−	\| `services/runner` \| TypeScript \| core \| Sandboxes on Cloudflare Containers, one per job, with their egress \| The Container classes \| `actions`, `billing`, `deployments`, `events`, `identity`, `repos`, `work` \|
30		−	\| `services/deployments` \| TypeScript \| core \| Builds and serves apps on `g1t.page`, previews, custom domains \| D1 `g1t-deployments`, the domains KV, the dispatch namespace \| `actions`, `billing`, `events`, `identity`, `og`, `projects`, `repos`, `runner`, `telemetry`, `work` \|
31		−	\| `services/pages` \| TypeScript \| edge \| The dispatcher for `*.g1t.page` and custom domains \| Nothing; reads the domains KV \| none \|
32		−	\| `services/packages` \| Rust \| core \| npm, Cargo, Composer, Maven, NuGet, RubyGems, Go and container images \| D1 `g1t-packages`, the packages bucket \| `billing`, `events`, `identity`, `repos` \|
33		−	\| `services/security` \| Rust \| core \| Secret scanning, dependency alerts and updates, code scanning, the supply chain \| D1 `g1t-security` \| `actions`, `billing`, `events`, `identity`, `repos`, `runner`, `work` \|
34		−	\| `services/search` \| Rust \| core \| Site search over repositories, work items, pull requests, people and code \| D1 `g1t-search`, its jobs queue \| `billing`, `identity`, `repos`, `work` \|
35		−	\| `services/projects` \| TypeScript \| core \| Projects and what they depend on \| D1 `g1t-projects` \| `deployments`, `events`, `identity`, `og`, `packages`, `repos` \|
36		−	\| `services/chat` \| TypeScript \| core \| Channels, direct messages and threads, live \| D1 `g1t-chat`, a Durable Object per channel \| `identity`, `integrations`, `notify` \|
37		−	\| `services/artifacts` \| TypeScript \| core \| Docs written together, live, with their spaces, sharing and search \| D1 `g1t-docs`, its files bucket, two Vectorize indexes, a Durable Object per open doc \| `billing`, `events`, `identity`, `notify`, `repos`, `work` \|
38		−	\| `services/notify` \| TypeScript \| core \| Notifications, live pages, presence, browser and phone push \| A Durable Object per person, per workspace and per repository \| `identity` \|
39		−	\| `services/telemetry` \| TypeScript \| core \| Logs, traces, metrics and errors for projects, at `otel.g1t.sh` \| A Durable Object per project \| `billing` \|
40		−	\| `services/billing` \| Rust \| core \| Usage, holds and settlements, limits, Stripe \| D1 `g1t-billing` \| `identity`, `packages`, `repos` \|
41		−	\| `services/integrations` \| Rust \| core \| The workspace's AI providers and Ask g1t, alert sources, issue trackers, the GitHub App \| D1 `g1t-integrations` \| `identity`, `projects`, `repos`, `work` \|
42		−	\| `services/webhooks` \| Rust \| core \| Webhook subscriptions and signed deliveries with retries \| D1 `g1t-webhooks` \| `identity`, `repos` \|
43		−	\| `services/og` \| TypeScript \| core \| Social cards and page screenshots, at `og.g1t.sh` \| The screenshots bucket \| `billing`, `identity`, `projects`, `repos`, `work` \|
	17	+	\| Unit \| Language \| Stage \| What it does \| Owns \| Calls \|
	18	+	\| --- \| --- \| --- \| --- \| --- \| --- \|
	19	+	\| `apps/web` \| TypeScript \| front \| The site on `g1t.sh`: pages, git over HTTPS and the package registries passed to their services, and `g1tusercontent.com` \| The downloads bucket \| `actions`, `artifacts`, `billing`, `chat`, `deployments`, `events`, `identity`, `integrations`, `notify`, `og`, `packages`, `projects`, `repos`, `search`, `security`, `telemetry`, `webhooks`, `work` \|
	20	+	\| `apps/api` \| Rust \| edge \| REST, MCP, OAuth, the runner protocol, OTLP ingest, Actions toolkit and OIDC \| Nothing; writes Actions cache and artifact files \| `actions`, `artifacts`, `billing`, `deployments`, `events`, `identity`, `integrations`, `packages`, `projects`, `repos`, `runner`, `search`, `security`, `telemetry`, `webhooks`, `work` \|
	21	+	\| `apps/status` \| TypeScript \| edge \| `status.g1t.sh`: probes every minute and keeps incidents \| D1 `g1t-status` \| `billing`, `repos` \|
	22	+	\| `apps/sudo` \| TypeScript \| front \| g1t.sh's staff console, behind Cloudflare Access \| Nothing \| `actions`, `billing`, `events`, `identity`, `projects`, `status`, `telemetry` \|
	23	+	\| `apps/docs` \| Astro \| front \| `docs.g1t.sh`, these pages \| Nothing \| none \|
	24	+	\| `services/identity` \| Rust \| core \| Accounts, sessions, workspaces, members, teams, repository roles, tokens, OAuth, device sign-in, 2FA \| D1 `g1t`, the avatars KV \| `artifacts`, `billing`, `chat`, `events`, `notify`, `projects`, `repos` \|
	25	+	\| `services/repos` \| Rust \| core \| Repositories and git: smart HTTP, pre-receive checks, caches, forks, landing merges, releases, backups \| D1 `g1t-repos`, the git store, the git cache KV, the packs and backups buckets \| `billing`, `events`, `identity`, `security`, `work` \|
	26	+	\| `services/work` \| Rust \| core \| Work items, pull requests, comments, reviews, labels, milestones, rulesets, checks, statuses, CODEOWNERS, the merge queue \| D1 `g1t-work` \| `actions`, `events`, `identity`, `integrations`, `repos` \|
	27	+	\| `services/events` \| Rust \| core \| The event bus and log, the audit log, the inbox \| D1 `g1t-events`, the `g1t-events` queue and its subscriber queues \| `billing`, `identity`, `notify`, `repos`, `work` \|
	28	+	\| `services/actions` \| Rust \| core \| Workflows: reading them, triggering runs, planning jobs, secrets, self-hosted runners, logs \| D1 `g1t-actions`; lists and expires the Actions cache bucket \| `billing`, `deployments`, `events`, `identity`, `notify`, `projects`, `repos`, `runner`, `work` \|
	29	+	\| `services/runner` \| TypeScript \| core \| Sandboxes on Cloudflare Containers, one per job, with their egress \| The Container classes \| `actions`, `billing`, `deployments`, `events`, `identity`, `repos`, `work` \|
	30	+	\| `services/deployments` \| TypeScript \| core \| Builds and serves apps on `g1t.page`, previews, custom domains \| D1 `g1t-deployments`, the domains KV, the dispatch namespace \| `actions`, `billing`, `events`, `identity`, `og`, `projects`, `repos`, `runner`, `telemetry`, `work` \|
	31	+	\| `services/pages` \| TypeScript \| edge \| The dispatcher for `*.g1t.page` and custom domains \| Nothing; reads the domains KV \| none \|
	32	+	\| `services/packages` \| Rust \| core \| npm, Cargo, Composer, Maven, NuGet, RubyGems, Go and container images \| D1 `g1t-packages`, the packages bucket \| `billing`, `events`, `identity`, `repos` \|
	33	+	\| `services/security` \| Rust \| core \| Secret scanning, dependency alerts and updates, code scanning, the supply chain \| D1 `g1t-security` \| `actions`, `billing`, `events`, `identity`, `repos`, `runner`, `work` \|
	34	+	\| `services/search` \| Rust \| core \| Site search over repositories, work items, pull requests, people and code \| D1 `g1t-search`, its jobs queue \| `billing`, `identity`, `repos`, `work` \|
	35	+	\| `services/projects` \| TypeScript \| core \| Projects and what they depend on \| D1 `g1t-projects` \| `deployments`, `events`, `identity`, `og`, `packages`, `repos` \|
	36	+	\| `services/chat` \| TypeScript \| core \| Channels, direct messages and threads, live \| D1 `g1t-chat`, a Durable Object per channel \| `identity`, `integrations`, `notify` \|
	37	+	\| `services/artifacts` \| TypeScript \| core \| Docs written together, live, with their spaces, sharing and search \| D1 `g1t-docs`, its files bucket, two Vectorize indexes, a Durable Object per open doc \| `billing`, `events`, `identity`, `notify`, `repos`, `work` \|
	38	+	\| `services/notify` \| TypeScript \| core \| Notifications, live pages, presence, browser and phone push \| A Durable Object per person, per workspace and per repository \| `identity` \|
	39	+	\| `services/telemetry` \| TypeScript \| core \| Logs, traces, metrics and errors for projects, at `otel.g1t.sh` \| A Durable Object per project \| `billing` \|
	40	+	\| `services/billing` \| Rust \| core \| Usage, holds and settlements, limits, Stripe \| D1 `g1t-billing` \| `identity`, `packages`, `repos` \|
	41	+	\| `services/integrations` \| Rust \| core \| The workspace's AI providers and Ask g1t, alert sources, issue trackers, the GitHub App \| D1 `g1t-integrations` \| `identity`, `projects`, `repos`, `work` \|
	42	+	\| `services/webhooks` \| Rust \| core \| Webhook subscriptions and signed deliveries with retries \| D1 `g1t-webhooks` \| `identity`, `repos` \|
	43	+	\| `services/og` \| TypeScript \| core \| Social cards and page screenshots, at `og.g1t.sh` \| The screenshots bucket \| `billing`, `identity`, `projects`, `repos`, `work` \|
44	44
45	45		Calls go both ways in places, `repos` and `work` for one. That is allowed:
46	46		bindings only have to respect the deploy stages, and every service is in
⋯
74	74		{ "ok": false, "error": { "code": "not_found", "message": "No pull request #12." } }
75	75		```
76	76
77		−	\| Status \| Means \| The caller gets \|
78		−	\| -------------------- \| --------------------------------------------------- \| ---------------------------------------------------------------------- \|
79		−	\| 200 with `ok: true` \| It worked \| The value \|
	77	+	\| Status \| Means \| The caller gets \|
	78	+	\| --- \| --- \| --- \|
	79	+	\| 200 with `ok: true` \| It worked \| The value \|
80	80		\| 200 with `ok: false` \| An expected failure, with a code from `FailureCode` \| A value to handle, such as `Result` in TypeScript or `Outcome` in Rust \|
81		−	\| 404 \| No such method \| An error \|
82		−	\| 503 \| A store is busy, with `Retry-After` \| An error \|
83		−	\| 500 \| Something threw \| An error \|
	81	+	\| 404 \| No such method \| An error \|
	82	+	\| 503 \| A store is busy, with `Retry-After` \| An error \|
	83	+	\| 500 \| Something threw \| An error \|
84	84
85	85		On the Rust side, `g1t_kit::call(&binding, "method", &args)` sends a call
86	86		and `rpc_method`, `args` and `reply` serve one (`crates/kit/src/lib.rs`).
⋯
99	99		Services share types, never code. Each one depends on the contracts, and
100	100		none on another service's crate or package.
101	101
102		−	\| Package \| Holds \|
103		−	\| --------------------------------------- \| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- \|
104		−	\| `crates/contracts` (`g1t-contracts`) \| A module per service with its data and its methods' arguments; `Outcome` and `Failure`; the event envelope and every event's data; `ROUTES`, which says which events each subscriber queue gets; `access`, the access rules every service compiles in; `scopes`; ids \|
105		−	\| `packages/contracts` (`@g1t/contracts`) \| The same for TypeScript: each service's API type (`IdentityApi`, `ReposApi`, …), typed clients, `Result` and `FailureCode`, events, scopes, rate limits, the D1 session helper. TypeScript source, with no build step. \|
106		−	\| `crates/kit` (`g1t-kit`) \| Plumbing for Rust Workers: the call protocol, D1 sessions and `Server-Timing` (`d1.rs`), rate limits that fail open, billing's platform pause, the snake_case converter, and handlers every service shares for renames, transfers and deletions \|
	102	+	\| Package \| Holds \|
	103	+	\| --- \| --- \|
	104	+	\| `crates/contracts` (`g1t-contracts`) \| A module per service with its data and its methods' arguments; `Outcome` and `Failure`; the event envelope and every event's data; `ROUTES`, which says which events each subscriber queue gets; `access`, the access rules every service compiles in; `scopes`; ids \|
	105	+	\| `packages/contracts` (`@g1t/contracts`) \| The same for TypeScript: each service's API type (`IdentityApi`, `ReposApi`, …), typed clients, `Result` and `FailureCode`, events, scopes, rate limits, the D1 session helper. TypeScript source, with no build step. \|
	106	+	\| `crates/kit` (`g1t-kit`) \| Plumbing for Rust Workers: the call protocol, D1 sessions and `Server-Timing` (`d1.rs`), rate limits that fail open, billing's platform pause, the snake_case converter, and handlers every service shares for renames, transfers and deletions \|
107	107
108	108		Where the two languages must agree exactly, a Rust test reads the
109	109		TypeScript file and compares: the access table (`access.rs`), scopes, and
⋯
119	119
120	120		## Shared crates
121	121
122		−	\| Crate \| What it is \|
123		−	\| ------------------ \| ------------------------------------------------------------------------------------------------------------------------- \|
124		−	\| `crates/rules` \| The rulesets engine, with no I/O: which rules apply to a ref, and whether a push or a merge passes them \|
125		−	\| `crates/scan` \| Detectors for secrets, a git pack reader, lockfiles, OSV, the dependency graph, SPDX and SARIF \|
126		−	\| `crates/secrets` \| `Sealer`, AES-256-GCM with the row's id as associated data, and HMAC signatures \|
127		−	\| `crates/blobstore` \| The `BlobStore` port, with R2 and S3 adapters \|
128		−	\| `crates/actions` \| Workflow syntax, expressions, filters, matrices and cron, with no I/O, used by both the `actions` service and the sandbox \|
129		−	\| `crates/runner` \| `g1t-runner`, the binary every sandbox and self-hosted runner runs \|
130		−	\| `crates/g1t` \| [The g1t CLI](/guides/cli/) \|
131		−	\| `crates/sshd` \| An SSH front end for git, not deployed yet \|
	122	+	\| Crate \| What it is \|
	123	+	\| --- \| --- \|
	124	+	\| `crates/rules` \| The rulesets engine, with no I/O: which rules apply to a ref, and whether a push or a merge passes them \|
	125	+	\| `crates/scan` \| Detectors for secrets, a git pack reader, lockfiles, OSV, the dependency graph, SPDX and SARIF \|
	126	+	\| `crates/secrets` \| `Sealer`, AES-256-GCM with the row's id as associated data, and HMAC signatures \|
	127	+	\| `crates/blobstore` \| The `BlobStore` port, with R2 and S3 adapters \|
	128	+	\| `crates/actions` \| Workflow syntax, expressions, filters, matrices and cron, with no I/O, used by both the `actions` service and the sandbox \|
	129	+	\| `crates/runner` \| `g1t-runner`, the binary every sandbox and self-hosted runner runs \|
	130	+	\| `crates/g1t` \| [The g1t CLI](/guides/cli/) \|
	131	+	\| `crates/sshd` \| An SSH front end for git, not deployed yet \|
132	132
133	133		## Adding a service
134	134

29	29		Three Cloudflare services are replaced by small Workers bound in their
30	30		place, so no service's code changes:
31	31
32		−	\| Binding \| Stands in for \| Self-hosted \|
33		−	\| ---------- \| ------------------------------------------------------------------------------------- \| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- \|
	32	+	\| Binding \| Stands in for \| Self-hosted \|
	33	+	\| --- \| --- \| --- \|
34	34		\| `GITSTORE` \| Cloudflare Artifacts, where g1t.sh keeps repositories (the repos service's git store) \| `deploy/self-host/workers/gitstore`, in front of the git store: bare repositories on the `g1t-git` volume, served with `git http-backend`. Access tokens are HMAC-signed, scoped and expire. Forks are clones with hard-linked objects. \|
35		−	\| `EMAIL` \| Cloudflare Email Sending \| `deploy/self-host/workers/mail`: logs each message and hands it to Mailpit, which can relay through your SMTP server \|
36		−	\| The runner \| Containers \| `deploy/self-host/workers/off`: answers that the feature is off, which every page that uses them shows \|
	35	+	\| `EMAIL` \| Cloudflare Email Sending \| `deploy/self-host/workers/mail`: logs each message and hands it to Mailpit, which can relay through your SMTP server \|
	36	+	\| The runner \| Containers \| `deploy/self-host/workers/off`: answers that the feature is off, which every page that uses them shows \|
37	37
38	38		## What is in `deploy/self-host`
39	39
40		−	\| File \| What it is \|
41		−	\| -------------------- \| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- \|
42		−	\| `docker-compose.yml` \| The services: `g1t`, `status`, `gitstore`, `rustfs` (S3-compatible storage), `storage-setup` (makes the buckets once, then exits) and `mailpit`. Volumes: `g1t-data`, `g1t-git`, `g1t-objects`, `g1t-status`, `g1t-secrets`. \|
43		−	\| `Dockerfile` \| Compiles the Rust services to WebAssembly and builds the site, as g1t.sh's deploys do. The image has Node, Wrangler, workerd and the built Workers. \|
44		−	\| `start.sh` \| Makes the sealing keys on first start, writes the configs, applies database migrations, then starts both workerd processes and the scheduler. \|
45		−	\| `configs.mjs` \| Writes each Worker's self-hosted config from its `wrangler.jsonc`: drops routes, the account and placement, binds the stand-ins above, points packages, backups, clone packs and files in pages at the S3 store, and replaces g1t.sh's addresses with yours. What runs, and what is bound to the off stand-in, comes from each part's `self_host` field in `deploy/stack.jsonc`. \|
46		−	\| `scheduler.mjs` \| Runs scheduled jobs (below). \|
47		−	\| `gitstore/` \| The git store. \|
48		−	\| `workers/` \| The three stand-ins. \|
49		−	\| `smoke.sh` \| The end-to-end check in [Check an installation](/guides/self-hosting/#check-an-installation). \|
	40	+	\| File \| What it is \|
	41	+	\| --- \| --- \|
	42	+	\| `docker-compose.yml` \| The services: `g1t`, `status`, `gitstore`, `rustfs` (S3-compatible storage), `storage-setup` (makes the buckets once, then exits) and `mailpit`. Volumes: `g1t-data`, `g1t-git`, `g1t-objects`, `g1t-status`, `g1t-secrets`. \|
	43	+	\| `Dockerfile` \| Compiles the Rust services to WebAssembly and builds the site, as g1t.sh's deploys do. The image has Node, Wrangler, workerd and the built Workers. \|
	44	+	\| `start.sh` \| Makes the sealing keys on first start, writes the configs, applies database migrations, then starts both workerd processes and the scheduler. \|
	45	+	\| `configs.mjs` \| Writes each Worker's self-hosted config from its `wrangler.jsonc`: drops routes, the account and placement, binds the stand-ins above, points packages, backups, clone packs and files in pages at the S3 store, and replaces g1t.sh's addresses with yours. What runs, and what is bound to the off stand-in, comes from each part's `self_host` field in `deploy/stack.jsonc`. \|
	46	+	\| `scheduler.mjs` \| Runs scheduled jobs (below). \|
	47	+	\| `gitstore/` \| The git store. \|
	48	+	\| `workers/` \| The three stand-ins. \|
	49	+	\| `smoke.sh` \| The end-to-end check in [Check an installation](/guides/self-hosting/#check-an-installation). \|
50	50
51	51		## Each part
52	52
53		−	\| Part \| Self-hosted \|
54		−	\| ----------------------- \| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- \|
55		−	\| `apps/web` \| Runs: the site, on `G1T_PORT` \|
56		−	\| `apps/api` \| Runs in the second workerd, on `API_PORT`. `API_URL` is its OAuth issuer and MCP is at `/mcp` on it. Actions artifacts need the runner, which is off. \|
57		−	\| `apps/status` \| Runs in a process of its own; see [the status page](/guides/self-hosting/#the-status-page) \|
58		−	\| `apps/sudo` \| Not run. It is g1t.sh's staff console, behind Cloudflare Access. \|
59		−	\| `apps/docs` \| Not run: docs.g1t.sh serves these pages \|
60		−	\| `services/identity` \| Runs; its email goes to Mailpit \|
61		−	\| `services/repos` \| Runs, against the git store. Nightly backups are queued but cut by the runner, which is off, so none are made yet. Clone packs are kept in the `g1t-git-packs` bucket. \|
62		−	\| `services/work` \| Runs \|
63		−	\| `services/events` \| Runs: the event bus, on local queues \|
64		−	\| `services/projects` \| Runs \|
65		−	\| `services/search` \| Runs: site search is SQLite full-text search \|
66		−	\| `services/chat` \| Runs, with its Durable Objects; custom emoji are kept with avatars \|
67		−	\| `services/artifacts` \| Runs: [artifacts](/guides/artifacts/) and their spaces, with their live rooms. Files people add are kept in the `g1t-docs-files` bucket. Search matches words, not meaning, because there is no embedding model. \|
68		−	\| `services/telemetry` \| Runs. Observability for projects: each project's logs, traces, metrics and errors in a Durable Object's SQLite storage. Software sends OpenTelemetry to the API's port, at `http://localhost:8789/otlp` ([Observability](/guides/observability/)). Deployments on `g1t.page`, the other source, are off. \|
69		−	\| `services/notify` \| Runs. Notifications are live in open tabs; browser push needs a VAPID key pair, which an installation does not make. Push to the phone app goes through Expo and needs nothing set; `PHONE_PUSH=off` sends phones nothing ([the phone app](/guides/self-hosting/#the-phone-app)). \|
70		−	\| `services/billing` \| Runs with nothing charged and no usage limit \|
71		−	\| `services/integrations` \| Runs \|
72		−	\| `services/webhooks` \| Runs, retries included \|
73		−	\| `services/actions` \| Runs. Jobs need the runner, which is off. \|
74		−	\| `services/packages` \| Runs, with files in the `g1t-packages` bucket and no request size limit \|
75		−	\| `services/security` \| Runs, with its sweeps on schedule \|
76		−	\| `services/deployments` \| Runs with no Cloudflare token, so nothing deploys; its pages and settings still show \|
77		−	\| `services/runner` \| Off: checks run by g1t, merge queue testing and workflow jobs \|
78		−	\| `services/pages` \| Not run: there is no `g1t.page` \|
79		−	\| `services/og` \| Not run: pages have no social cards \|
	53	+	\| Part \| Self-hosted \|
	54	+	\| --- \| --- \|
	55	+	\| `apps/web` \| Runs: the site, on `G1T_PORT` \|
	56	+	\| `apps/api` \| Runs in the second workerd, on `API_PORT`. `API_URL` is its OAuth issuer and MCP is at `/mcp` on it. Actions artifacts need the runner, which is off. \|
	57	+	\| `apps/status` \| Runs in a process of its own; see [the status page](/guides/self-hosting/#the-status-page) \|
	58	+	\| `apps/sudo` \| Not run. It is g1t.sh's staff console, behind Cloudflare Access. \|
	59	+	\| `apps/docs` \| Not run: docs.g1t.sh serves these pages \|
	60	+	\| `services/identity` \| Runs; its email goes to Mailpit \|
	61	+	\| `services/repos` \| Runs, against the git store. Nightly backups are queued but cut by the runner, which is off, so none are made yet. Clone packs are kept in the `g1t-git-packs` bucket. \|
	62	+	\| `services/work` \| Runs \|
	63	+	\| `services/events` \| Runs: the event bus, on local queues \|
	64	+	\| `services/projects` \| Runs \|
	65	+	\| `services/search` \| Runs: site search is SQLite full-text search \|
	66	+	\| `services/chat` \| Runs, with its Durable Objects; custom emoji are kept with avatars \|
	67	+	\| `services/artifacts` \| Runs: [artifacts](/guides/artifacts/) and their spaces, with their live rooms. Files people add are kept in the `g1t-docs-files` bucket. Search matches words, not meaning, because there is no embedding model. \|
	68	+	\| `services/telemetry` \| Runs. Observability for projects: each project's logs, traces, metrics and errors in a Durable Object's SQLite storage. Software sends OpenTelemetry to the API's port, at `http://localhost:8789/otlp` ([Observability](/guides/observability/)). Deployments on `g1t.page`, the other source, are off. \|
	69	+	\| `services/notify` \| Runs. Notifications are live in open tabs; browser push needs a VAPID key pair, which an installation does not make. Push to the phone app goes through Expo and needs nothing set; `PHONE_PUSH=off` sends phones nothing ([the phone app](/guides/self-hosting/#the-phone-app)). \|
	70	+	\| `services/billing` \| Runs with nothing charged and no usage limit \|
	71	+	\| `services/integrations` \| Runs \|
	72	+	\| `services/webhooks` \| Runs, retries included \|
	73	+	\| `services/actions` \| Runs. Jobs need the runner, which is off. \|
	74	+	\| `services/packages` \| Runs, with files in the `g1t-packages` bucket and no request size limit \|
	75	+	\| `services/security` \| Runs, with its sweeps on schedule \|
	76	+	\| `services/deployments` \| Runs with no Cloudflare token, so nothing deploys; its pages and settings still show \|
	77	+	\| `services/runner` \| Off: checks run by g1t, merge queue testing and workflow jobs \|
	78	+	\| `services/pages` \| Not run: there is no `g1t.page` \|
	79	+	\| `services/og` \| Not run: pages have no social cards \|
80	80
81	81		## Scheduled jobs
82	82
⋯
99	99		point `S3_ENDPOINT` at (MinIO, Ceph, Garage or AWS S3). `storage-setup`
100	100		makes them on the bundled store; on another store, make them yourself.
101	101
102		−	\| Bucket \| Holds \| Setting \|
103		−	\| ---------------- \| --------------------------------------------------------------------------------------------------------------------------- \| ------------------ \|
104		−	\| `g1t-packages` \| Container image layers and other package files \| `S3_BUCKET` \|
105		−	\| `g1t-git-packs` \| Packs for fresh clones, a cache. Give it a rule that deletes objects after 7 days and aborts multipart uploads after a day. \| `PACK_S3_BUCKET` \|
106		−	\| `g1t-backups` \| Nightly repository backups, once the runner cuts them \| `BACKUP_S3_BUCKET` \|
107		−	\| `g1t-docs-files` \| Images and files added to pages and artifacts \| `DOCS_S3_BUCKET` \|
	102	+	\| Bucket \| Holds \| Setting \|
	103	+	\| --- \| --- \| --- \|
	104	+	\| `g1t-packages` \| Container image layers and other package files \| `S3_BUCKET` \|
	105	+	\| `g1t-git-packs` \| Packs for fresh clones, a cache. Give it a rule that deletes objects after 7 days and aborts multipart uploads after a day. \| `PACK_S3_BUCKET` \|
	106	+	\| `g1t-backups` \| Nightly repository backups, once the runner cuts them \| `BACKUP_S3_BUCKET` \|
	107	+	\| `g1t-docs-files` \| Images and files added to pages and artifacts \| `DOCS_S3_BUCKET` \|
108	108
109	109		Requests to the store are signed with AWS Signature Version 4, path style.
110	110

17	17		apps/docs/src/content/docs/reference/cli.md
18	18		apps/docs/src/data/openapi.json
19	19		**/worker-configuration.d.ts
	20	+	# Tables the deploy tool's tests read row by row (scripts/deploy/deploy.test.mjs).
	21	+	apps/docs/src/content/docs/architecture/services.md
	22	+	apps/docs/src/content/docs/guides/self-hosting-architecture.md

flagon-io/g1t

Prettier leaves the two architecture tables the deploy tool's tests read alone

Comments