gitdrBack up your whole git org to storage nobody can delete.
gitdr mirrors every repo to WORM-immutable object storage, checks the lock before it writes a single byte, and signs what it stored. One static binary. No agents, no phone-home, your bucket and your keys.
go install gitdr.io/gitdr/cmd/gitdr@latestA single job that runs the whole chain.
No control plane, no daemon. You point it at a source and a bucket, it does these five things in order and exits non-zero if any of them fail.
Enumerate
List every repo in the org over read-only source scopes.
Verify WORM
Probe object-lock or retention. No lock, loud warning, or fail closed.
Bundle
Full mirror clone plus LFS, packed into one git bundle, SHA-256 streamed.
Upload
Create-only put with a retain-until date. Nothing ever overwrites.
Sign
An ed25519-signed manifest of the whole run, keys, sizes and checksums.
Built so a bad day, or a bad actor, can't erase the backup.
WORM, or it tells you loud
Before the first byte, gitdr checks the destination is immutable (S3 object-lock, GCS retention, Azure policy). If it can't confirm, it warns hard and keeps going, or stops cold with --require-worm. WORM is your responsibility, but you'll never be quietly unprotected.
No delete. By construction.
The storage layer has no delete, remove, or overwrite method anywhere in the codebase. Backups are append-only because the code physically cannot do otherwise. Uploads are create-only, so a collision fails instead of clobbering.
Everything is signed and checked
Every artifact gets a SHA-256. Every run writes a signed manifest. gitdr verify re-downloads each object and re-checks the signature and every hash, so you find out it's intact before you need it, not after.
Your creds, your bucket, no telemetry
Uses each cloud's default credential chain, so keyless workload identity just works. Secrets come from env only and are redacted everywhere. Zero analytics, zero phone-home. It's a tool you can read end to end.
Any major object store. Any git host.
If it speaks S3, retention, or immutability policy, gitdr can lock a backup into it. Most have a free tier, so there's no excuse.
Git history, branches, tags and LFS restore as a true mirror. Issues, PRs and releases are captured as an audit record.
Ship it three ways.
Same static binary underneath. Run it from a shell, a container, or a Kubernetes CronJob on a schedule.
Go or a release download
$ go install gitdr.io/gitdr/cmd/gitdr@latestStatic, Linux amd64 and arm64. Also on the GitHub releases page with checksums and signatures.
Hardened image
$ docker run ghcr.io/gitdr-io/gitdr backup --config gitdr.yamlWolfi base, non-root, read-only rootfs, no shell. Ships git and git-lfs, signed with cosign.
Helm CronJob
$ helm install gitdr oci://ghcr.io/gitdr-io/charts/gitdrRuns on a schedule, writes a last-successful-run metric your alerting can watch.