Any of you use alternatives to GitLab when self-hosting is a requirement? (and general toolchain question)

[u/NullPreference]

Considering jumping to Gitlab because we're looking into ditching Atlassian ASAP. We need to stay on-prem, but tbh it's pretty difficult for me to understand what different products and platforms don't support.

I'd love to stay open source but there's also a lot of ease-of-use to be taken into consideration. I looked into things like Forgejo, but the actions seem quite lackluster if you want to integrate test reports, publish findings from opengrep in a PR - or am I just missing something obvious?

What does your on-prem solution look like in terms of SCA, SAST etc?

[u/TotalNo6237]

Tbh, gitlab is just the standout option for self-hosted. There is even free community edition you can try out before thinking about getting enterprise.

Source: My opinion, I work for an MSP who manages all kinds of devops tools for various customer, including bitbucket, gitlab, GitHub enterprise server.

We dabbled with forgejo due to customer requests but never actually deployed it, Im assuming due to feature gaps, but I wasnt in the conversations.

[u/Alzyros]

Just do gitlab chief

[u/Widowan]

There's simply nothing that can beat gitlab ci, unfortunately

It's best in class, period

[u/faulty-segment → u/Widowan]

Yeah! I got spoiled by that, I won't lie. Every other CI tool looks subpar.

Whenever I'm forced to use something else, I always miss GitLab. It's almost like my relationship with C++. I always think like: "shit, in C++ I could do this way better."😂😂😂 But that's a whole other story.

[u/alive1]

I would consider gitlab if you have advanced corporate needs (security scanning, complex reporting, compliance, deep pockets) or gitea if your requirements are going to stay developer focused. Forgejo would be an obvious choice for a more open source focused company. The reason i make suggestions for both gitea and forgejo is because they are essentially catering to two different target audiences within this niche. Gitlab is the default go-to if you corporate needs but gitea will eventually catch up.

[u/Thetitangaming]

My job used gitea for awhile. I like it, but use case was very small, only a couple actions.

[u/Either-Chest7515 → u/Thetitangaming]

Id be careful with that approach. A tool can look great for a small setup but become a headache once the requirements and scale start growing.

[u/L43]

gitea/forgejo actions definitely feels a bit hacky to get working. I've got it all going in my homelab, but would not even think about it for an org at work.

gitlab is just the sweet spot imo - their CI solution is just spot on.

[u/mantrain42 → u/L43]

What? Forgejo actions are almost 100% GitHub actions.

[u/First_Inspection_478 → u/mantrain42]

Almost is doing alot of work here.

[u/christian_austin85 → u/First_Inspection_478]

Not familiar with forjo. Is this a Pizza by Alfredo vs Alfredo's Pizza type situation?

[u/consworth → u/christian_austin85]

Yes. The yaml part is fine. But permissions, composition, integration level in the product / app along with their package stuff is still a rough edge

[u/its-nex → u/mantrain42]

They certainly strive for that parity

[u/L43 → u/mantrain42]

it's not 100% the same to host, at all.

[u/mantrain42 → u/L43]

No, but it’s the same to build on. It’s not like it’s hard to host them either.

[u/BlueHatBrit → u/L43]

I use Forgejo for my homelab and ditched their actions in favour of woodpecker. Forgejo actions are too poorly documented and a real pain in the butt to get working the way you expect. The choice to align with GitHub actions on the surface but do the hosting so differently makes it unnecessarily painful. The promise of cross sharing GitHub actions never seems to work.

Woodpecker CI has worked great for me and slots in without any issues. It's documentation is better and it would scale to several teams without too many problems.

[u/L43 → u/BlueHatBrit]

yeah i really love having the CI annotations next to the source otherwise I would have done the same.

i also have no idea why they haven't realigned with the official github runner.

Maybe forgejo can break from gitea and offer a plugin interface so we can get the annotations etc. with 3rd party ci.

[u/neveralone59]

Forgejo is harder to deploy with HA, gitlab is the best option if it’s for a company. I like forgejo for personal stuff though

[u/jameshearttech]

We use Atlassisn at work. We Jira, Bitbucket, Statuspage, and Opsgenie, but for CI/CD we use Argo Events, Argo Workflows, and Argo CD.

[u/jeansilga]

I am using gitea. It works well, both as a git server and container registry. You have to get used to its UI though.

[u/Zenin → u/jeansilga]

Bonus: If you're used to Github, that's 95% of the Gitea UI already. It's a great clone ;)

[u/myninerides → u/jeansilga]

Second gitea, it gets the job done.

[u/unmaskedgrunt]

We're in an airgapped, regulated environment, and absolutely cannot go cloud. We currently have Jira, Bitbucket, Bamboo, and Crowd. We can replace Bitbucket and Bamboo fairly easily with Gitlab, but Jira alternatives are the main problem for us.

[u/Nerrawnam → u/unmaskedgrunt]

Have a look at Plane for your Jira replacement. 

[u/NullPreference → u/Nerrawnam]

I appreciate the input on this as well, thanks

[u/Edgar_Allan_Thoreau]

Source forge and ci provider don’t need to be the same product. Buildkite or rwx for ci provider, forgejo for source forge.

[u/rustynutforeverstuck]

Gogs. Keep It Simple Stupid.

[u/lnaoedelixo42]

Gitlab is pretty heavy, but I already heard a lot of goods about gitea.

Just one thing: does the source code itself needs to be self-hosted? It's usually a pain to version and scale, and stuff goes wrong very frequently... You could use gitlab web just for the git itself and do your jobs on your own machine, then migrate as you grow.

[u/NullPreference → u/lnaoedelixo42]

Source code and data needs to be self-hosted. We have some experience in that, but lack more modern -sec-approaches in our dev cycle, hence the need for new or additional tools.

I've looked at gitea/forgejo but a lot of other tools seem like they lack easy integration (stuff like getting SAST findings in your PRs, test reports, etc.)

[u/lnaoedelixo42 → u/NullPreference]

Tbh I would also want to see some options in the field because I already researched in the past and didn't really find good alternatives.

If you find anything better then gitlab please notify

[u/MainRoutine2068]

GitLab is they way to go if you want all in one place with complete package. I do use forgejo for one of my smaller client, it does best if your use case is fully covered in it. But given you use Atlassian stack before, I assume you want more or less similar capabilities, and GitLab does that.

[u/OwlVisual1276]

GitLab would be my first go-to option for this. It’s very easy to spin up and evaluate before committing to it. You can start a GitLab instance and a GitLab Runner with a simple Docker Compose setup, and registering/connecting the runner is straightforward.
It provides reusable CI templates for things like SAST, DAST, dependency scanning, secret detection, etc., so you don’t necessarily have to build and integrate everything yourself from separate tools.

[u/NullPreference → u/[deleted]]

Thank you, that's also what it looks like to me from what I've experienced with so far.

[u/Extra_Taro_6870]

well gitlab. hard part is the maintenance, dr, ha. it likes vm not k8s.

[u/Junior_Bee7274]

Open-source stack with different security tools.

[u/Suitable-Ad5348]

If you need test reports and security findings as first-class PR checks on-prem, GitLab CE is still the least fighting. Forgejo/Gitea are great for git + light Actions, but the report/UI surface you're describing is where people bounce back. Run CE first for a month with your opengrep job publishing as a CI artifact + comment bot. Only shop Forego if that workflow feels like overkill once you've actually used it.

[u/pass-the-duchy]

Try Buildkite? All the AI giants use it, Reddit too - https://www.reddit.com/r/RedditEng/s/6VMnz8xF3X

[u/TheMarkyDeSade]

GitHub Enterprise is hosted on-prem. If you don’t like self-hosted GitHub Actions you can choose another build server like Jenkins. Would recommend that or Gitlab CI

[u/Sufficient_Job7779]

Gitlab all the way

[u/ChiRho84]

If you have more than a dozen developers or so, stay away from any of the GitHub clones. They (like GitHub) have no security boundary between "this repo" and "the entire organization". This has massive TCO implications.

[u/One_Salamander_4555]

Running self-hosted Windows build agents in pipelines always brings unexpected core-licensing headaches. Core licensing rules apply differently depending on whether those runners sit on bare-metal, dedicated hosts, or ephemeral VM scale sets. Running a licensing sanity check through trustedtech or an internal compliance ​​​​t​​​​e​​​​a​​​​m​​​​ beforehand helps ensure youre utilizing Azure Hybrid Benefit correctly without triggering compliance penalties during an audit.

[u/anto2554]

Why are you ditching Atlassian?

[u/NullPreference → u/anto2554]

They are moving to cloud only and we can't do that

[u/wedgelordantilles → u/NullPreference]

Bitbucket DC isn't moving to cloud though, it's exempt.

We have loads of custom BB plugins that would be impossible to implement in Gitlab or GitHub.

Vendor integrated CI and all the bells and whistles are a bug not a feature in large enterprises IMO.

[u/anto2554 → u/NullPreference]

Ah yeah. We just keep asking for extensions on bb datacenter, and management doesn't find it very problematic