# What is gitdr

Back up your whole git org to WORM-immutable object storage. One static binary, no telemetry.

gitdr backs up GitHub and GitLab organizations to object storage you own, and checks the
bucket is write-once (WORM) before it writes a thing. Deleted repo, popped account,
ransomware, and your history is still sitting somewhere they can't reach.

It's a single static Linux binary that runs as a one-shot job. No agents, no daemon, no
control plane, no phone-home. Point it at a source and a bucket, it does five things in
order and exits non-zero if any of them fail:

1. **Enumerate** every repo in the org over read-only source scopes.
2. **Verify WORM** on the destination. No lock means a loud warning, or a hard stop with
   `--require-worm`.
3. **Bundle** each repo, full mirror clone plus LFS, SHA-256 streamed.
4. **Upload** create-only with a retain-until date. Nothing ever overwrites.
5. **Sign** an ed25519 manifest of the whole run.

`gitdr restore` gets your repos back. `gitdr verify` re-downloads everything and checks
the signature and every hash, so you find out backups are intact before you need them.

## Where to next

- [Quickstart](/docs/quickstart/), zero to a verified immutable backup in about 10 minutes.
- [Install and verify](/docs/install/), get it, and prove what you downloaded.
- [WORM buckets](/docs/worm/), make the destination immutable, per provider.
- [Restore runbook](/docs/restore/), how to get repos back when it matters.
- [Security](/docs/security/), the design stance and how to report a vulnerability.
- [Source on GitHub](https://github.com/gitdr-io/gitdr), AGPL-3.0, read it end to end.

## What it never does

The storage layer has no delete, remove, or overwrite method anywhere in the codebase.
Backups are append-only by construction. There is no telemetry of any kind. Credentials
come from env or your cloud's default credential chain, never from code, and are redacted
in every log line.