DISCLAIMER: This page is for information only. It is not legal, financial or procurement advice and does not replace your own due diligence. Licenses, ownership, features and certifications can change: confirm what your decision rests on with the official sources.
🩺 Vitals
- 🟢 Last active: 2026-11-14
- 📦 Latest release: v17.0.1 (2026-10-26)
- 🐞 Open issues: 1640
- 🌟 Stars: 5.8k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent stable version the maintainers published as a release on the forge. Some healthy projects publish only tags, or publish their versions elsewhere.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: forgejo.org
- Source: codeberg.org/forgejo/forgejo
- License: GPLv3+
- Deployment: Docker | Native (Single Binary)
- Data Model: SQLite / PostgreSQL / MySQL
- Jurisdiction: Germany 🇩🇪 / EU 🇪🇺 (Codeberg e.V., Berlin)
- Compliance (SaaS): N/A (No First-Party SaaS)
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: Low (2/5) - Single binary or one container
- Maintenance: Low (2/5) - Drop-in binary upgrades; DB migrations on major versions
- User Management: High (4/5) - OAuth2/OIDC single sign-on, LDAP sign-in, 2FA, org/team RBAC and a user-attributed activity history all in the free build; no security-event audit log or SCIM yet (both are open feature requests)
1. The Executive Summary
What is it? Forgejo is a self-hosted software forge: Git repository hosting plus issues, pull requests, code review, a built-in CI/CD engine (Forgejo Actions, modelled on GitHub Actions, whose workflows may need changes to run), a package registry and a wiki, all in one lightweight package. It runs entirely on your own infrastructure, and its importer brings repositories, issues and pull requests over from GitHub and GitLab. The project forked from Gitea in December 2022, has been a hard fork since early 2024, and is stewarded by Codeberg e.V., a German non-profit association.
The Strategic Verdict:
- 🔴 For teams that need a vendor SLA and managed hosting out of the box: Caution. Forgejo is software, not a service. The project offers no first-party managed option and no commercial support desk, so you or a third-party host operate, patch and back it up. Teams that want a number to call should weigh GitLab's commercial tier or a managed Forgejo host.
- 🟢 For European SMEs, public bodies and teams leaving GitHub or GitLab: Strong Buy. Forgejo runs the entire development workflow on a single lightweight binary you control, under EU non-profit governance, with SSO, CI/CD and the package registry all in the free software. None of the per-seat or enterprise-tier gating that defines the incumbents applies.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | GitLab (SaaS) | Forgejo (Self-Hosted) |
|---|---|---|
| Per-seat Licensing | Monthly per-user fee, rising with tier | Free software, unlimited users |
| Enterprise Features | Merge approvals, compliance dashboards and advanced security gated to Premium and Ultimate | SSO, RBAC, 2FA and code review in the free build |
| Hosting Footprint | Self-managed install wants multiple GB of RAM as a baseline | A single Go binary that runs on a modest VPS |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: Forgejo ships as a single self-contained Go binary or an official Docker image. There is no application server, message broker or orchestration layer to assemble; you point it at SQLite for a small team or PostgreSQL/MySQL for a larger one and it is running in minutes. Forgejo Actions, the built-in CI/CD system, uses workflows modelled on GitHub Actions and runs jobs on a separately installed runner; existing pipelines need checking and may need changes before they run.
- Scalability: A single instance on a modest VPS comfortably serves a small-to-mid-sized team because the binary is lightweight. Growth means moving the database to PostgreSQL and putting object storage behind attachments. Horizontal scaling is less mature than GitLab's reference architectures, so very large deployments need hands-on capacity planning rather than a documented multi-node blueprint.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & Geopolitics: Forgejo is stewarded by Codeberg e.V., a registered democratic non-profit association based in Berlin, placing the project's steward inside the EU and beyond the reach of the US CLOUD Act. Because there is no first-party SaaS, self-hosting means no foreign-controlled service ever touches your source code. For an organization whose crown-jewel IP lives in its repositories, the jurisdiction of the steward and the absence of a hosted middleman is itself part of the threat model.
- The Compliance Shift: Forgejo holds no compliance certifications of its own. As fully self-hosted software, the entire burden (ISO 27001, SOC 2, access logging, retention) shifts to your infrastructure, IAM and policy layers. The forge supplies the building blocks (RBAC, OAuth2/OIDC, 2FA), but a compliant posture is something your team configures and operates, not a badge the project hands you. A security-event audit log (token creation, logins, changes to security settings) and SCIM provisioning are still open feature requests, not shipped capabilities.
- License Risk: Forgejo is GPLv3+ licensed, a strong copyleft. For standard internal use, and for running it as a service for your own organization, this triggers no distribution obligations and is effectively risk-free: unlike AGPL, the GPL has no network clause. The obligation only bites if you distribute a modified Forgejo binary, in which case your changes must be released under the same license. There is no Contributor License Agreement and no single corporate owner, which structurally prevents the relicensing "rug pull" the community feared when a for-profit company took control of Gitea in 2022.
4. Market Landscape
🏢 Proprietary Incumbents
- GitHub: The dominant forge, owned by Microsoft and hosted in the US. Convenient and feature-rich, but it is closed-source SaaS: your code, issues and CI logs live on infrastructure under US jurisdiction, and Enterprise capabilities carry per-seat pricing.
- GitLab: The leading self-hostable competitor, built on an open-core model. The free Community Edition is genuine, but merge approvals, compliance frameworks and advanced security sit behind the paid Premium and Ultimate tiers, and the self-managed install is resource-heavy.
🤝 Open Source Ecosystem
- Gitea: The project Forgejo forked from in 2022. Still MIT-licensed and capable, but now commercially steered by a US for-profit (CommitGo, Inc.); Forgejo differentiates on community non-profit governance and a copyleft license that cannot be taken proprietary.