Open-source CI/CD stack for dev teams in 2026

A small engineering team can run its whole development toolchain on six open-source tools: git, pipelines, a private registry, dashboards, secrets, and single sign-on. You give up GitHub's ecosystem; you keep ownership of your code, your build data, and a cost that does not move when your team grows.

• The stack: Gitea for git, Woodpecker CI for pipelines, Verdaccio for a private npm registry, Grafana for dashboards, Vault for secrets, and Keycloak for single sign-on.

• Run all six managed by us and the math is flat: 6 × €9 = €54/month, in the region you choose, across 21 datacenter regions on six continents.

• The equivalent SaaS toolchain — GitHub seats, CI minutes, a private registry, Datadog, a hosted secrets manager, and Okta — runs from roughly $195 to $510 or more per month at five developers, and climbs with every seat, host, and secret.

• The honest trade: GitHub's Actions marketplace and integrations are unmatched. Self-hosting swaps that breadth for cost you can predict and data you control.

• Start with two tools, not six. Put git on Gitea, wire one pipeline in Woodpecker, and evaluate for 14 days.

Who this stack is for (and who should stay on GitHub)

This list is for a small engineering team — say two to ten developers — that already pays for several developer tools separately and wants fewer invoices and more control. It is not for teams that lean on the GitHub Actions marketplace or want everything inside one vendor's bundle. For those teams, GitHub is the better choice.

GitHub's ecosystem is the reason most teams never leave. The Actions marketplace has thousands of prebuilt steps. Copilot sits in the editor. The integrations are everywhere, and most of the world's developers already have an account. Self-hosting trades that gravity for three things: a cost that does not scale with seats, source and build artifacts that stay on infrastructure you control, and no per-tool price creep.

If the marketplace breadth is load-bearing for your workflow, stay where you are. If predictable cost and data control matter more, the six tools below cover the whole loop.

The six tools, and what each one replaces

Each tool below does one job and replaces one paid SaaS slice. We host every one at €9 per app, per month, patched and backed up daily off-site, in the region you pick. The capsules name the license, the GitHub stars, what the tool replaces, and the one thing it does not do well.

Gitea — your git hosting

Gitea is a self-hosted git forge: repositories, pull requests, code review, issues, a kanban board, and a built-in package registry. It is written in Go, licensed MIT, and carries about 55,700 GitHub stars. It runs on a small server and starts in seconds. For most teams it covers what GitHub's core does: hosting code, reviewing pull requests, tracking issues, and tagging releases. Gitea also ships Gitea Actions, a built-in CI system whose syntax mirrors GitHub Actions, so existing workflow files mostly carry over.

The honest limit is community size. GitHub has the world's developers and an integration for nearly everything. Gitea's third-party surface is smaller. The community split in late 2022 when the Forgejo fork launched over governance concerns, and Forgejo became a fully independent project in early 2024. Both projects are healthy, but neither has GitHub's gravity. If your work depends on a long list of GitHub-only integrations, that gap is real.

We run managed Gitea for git hosting at €9/month. We patch it, back it up daily off-site, and keep it monitored. You push code; you do not run the server.

Woodpecker CI — your pipelines

Woodpecker CI runs your build and deploy pipelines. It is a community fork of Drone, licensed Apache 2.0, with about 6,400 GitHub stars. Every pipeline step runs in its own Docker container, and the server idles at roughly 100 MB of RAM. Pipelines are defined in a plain .woodpecker.yml file, and Woodpecker has first-class support for Gitea, so the git host and the CI engine fit together without glue code. A push to Gitea triggers a run; the run builds, tests, and deploys.

The honest limit is the plugin ecosystem. GitHub Actions has a marketplace with thousands of prebuilt actions, and that breadth is hard to match. Woodpecker's plugin catalog is far smaller, though Drone plugins are compatible and most build steps are a few shell commands anyway. Setup also asks more of you than a hosted runner: TLS, OAuth, and a reverse proxy. Self-hosted CI means someone owns the uptime.

That someone is us. We run Woodpecker CI for pipelines at €9/month, wired to your Gitea instance, patched and monitored. When a runner needs attention, a human on chat handles it.

Verdaccio — your private npm registry

Verdaccio is a private npm registry. It stores your internal packages and proxies the public npm registry, caching what your builds download. It is licensed MIT, carries about 17,700 GitHub stars, boots in seconds, and is fast enough to sit inside CI — many open-source projects use it for end-to-end tests. Point a project's .npmrc at Verdaccio and your private packages install exactly like public ones, without publishing your code to the public registry.

The honest limit is scope and staffing. Verdaccio is built for npm; it is not a multi-format artifact platform, so a team needing Maven, PyPI, and Docker in one place will outgrow it. It is also volunteer-maintained, with no full-time team and, by the maintainers' own note, no current funding for security research. The project is active and widely used, but it is community software, not a vendor product.

We run managed Verdaccio at €9/month, patched and backed up. Your private packages and your cache live on infrastructure you control, not inside a registry seat plan that bills per developer.

Grafana — your dashboards

Grafana turns metrics, logs, and traces into dashboards and alerts. It connects to more than 150 data sources, including Prometheus, Loki, and Postgres, and it is the most widely used open-source tool for the job. Grafana is licensed AGPLv3 — it moved from Apache 2.0 in 2021 — and carries more than 60,000 GitHub stars. You watch your deploys, your error rates, and your build health on one screen, and you set alerts when something crosses a line.

The honest limit is that Grafana is the visualization layer, not the whole observability stack. It needs a data source behind it — usually Prometheus for metrics — and that is a separate thing to run. Datadog bundles collection, dashboards, APM, and alerting into one product that works out of the box; Grafana asks you to assemble more pieces, and its query languages take time to learn. The trade is cost and control: Grafana plus Prometheus runs for a fraction of Datadog's per-host bill.

We run Grafana for dashboards at €9/month, patched and monitored, in the region you choose. The data stays yours.

Vault — your secrets

Vault stores and manages secrets: API keys, database passwords, certificates, and encryption keys. It hands secrets to your pipelines and apps at runtime, so credentials never sit in plain text in a repo or a CI variable. It records which client read which secret and when. Vault carries about 35,700 GitHub stars and is the most established tool in its category.

One honest point matters here. Vault is no longer open source in the strict sense. In 2023 its maker moved it to the Business Source License, which is source-available rather than OSI-approved; HashiCorp is now owned by IBM. The community responded with OpenBao, a fork under the Linux Foundation that keeps the MPL 2.0 open-source license and stays API-compatible. If a strictly open-source license is a hard requirement, OpenBao is the path; if you want the established tool, Vault is it. The other honest limit is operational weight: initialization, unsealing, and high availability are not trivial, and Vault ships security fixes almost monthly.

We run managed Vault at €9/month and carry that operational weight — the unseal flow, the patching, the backups — so your team does not.

Keycloak — one login across the toolchain

Keycloak is identity and single sign-on. It speaks OpenID Connect, OAuth 2.0, and SAML, connects to LDAP and Active Directory, and supports multi-factor login. Wire it in front of the other five tools and your team signs in once to reach Gitea, Woodpecker, Verdaccio, Grafana, and Vault. Keycloak began at Red Hat, is a CNCF project, is licensed Apache 2.0, and carries about 34,700 GitHub stars.

The honest limit is weight and complexity. Keycloak is full identity-and-access management, and it shows: the base configuration wants around 1.25 GB of RAM, and production deployments typically run 2 to 4 GB. Lighter single-sign-on tools exist if all you need is a login gate. Keycloak also ships frequent security patches that have to be applied promptly. Okta and Auth0 hide all of this behind a hosted console — that polish is what their per-user price buys.

We run managed Keycloak at €9/month and keep it patched. Your team gets one login across the stack; you do not run the identity server or chase its security releases.

How the six fit together

The six tools form one loop. A developer pushes code to Gitea. The push triggers a Woodpecker pipeline. The pipeline pulls dependencies from Verdaccio, builds, and deploys. You watch the result in Grafana. Vault hands each step the secrets it needs, and Keycloak gives the whole team one login across all six.

In practice it reads like this. A developer opens a pull request in Gitea and a teammate reviews it. On merge, Woodpecker starts a run defined in .woodpecker.yml. The run installs packages from Verdaccio — private ones you published, public ones it cached — then runs tests and ships the build. Throughout, the pipeline asks Vault for the database password and the deploy key rather than reading them from a file. After deploy, a Grafana dashboard shows error rates and response times, with an alert set for regressions. Everyone reached every tool through a single Keycloak login. No part of that loop sent your source, your packages, or your build logs to a vendor you do not control.

What the stack costs

Run all six with us and the math is simple: six apps at €9 each is €54 per month, flat, no matter how many developers, hosts, secrets, or build minutes you use. The equivalent SaaS toolchain at five developers runs from roughly $195 to $510 or more per month — and the number rises as you grow.

A few honest caveats sit behind that table. GitHub bundles some of these jobs — Actions for CI, Packages for a registry — so a GitHub-centric team may not buy every line separately. The SaaS figures are list prices in US dollars; real bills vary with usage and negotiated discounts. Datadog and the secrets managers are usage-priced, so their cost climbs with hosts and secret counts rather than seats. Okta's $1,500 annual minimum means even a three-person team pays a four-figure floor.

The pattern holds at any reasonable exchange rate: a flat €54 beats a usage-metered toolchain that starts near $200 and only grows. We do not bill per developer, and we will not raise your price because your team grew.

Start a 7-day free trial — no card needed.

How to start

Do not stand up six services at once. Start with two. Put your git on Gitea and wire one pipeline in Woodpecker, then run that pair for 14 days against real work. If it holds, add the registry, dashboards, secrets, and single sign-on one at a time.

A sensible order is git first, then CI, then the rest as you feel the need. Move one repository to Gitea and review a few pull requests there. Add a .woodpecker.yml to that repo and let one pipeline build and deploy. Once that loop is steady, point your .npmrc at Verdaccio, then add a Grafana dashboard for the service you just shipped. Bring in Vault when you want secrets out of CI variables, and Keycloak when one login across the tools starts to matter. Each tool is €9/month on its own, so you grow the stack at your own pace.

See how managed Gitea works.

Frequently asked questions

What is a self-hosted CI/CD stack?

It is the set of tools a team runs on its own infrastructure to write, build, and ship software: git hosting, a pipeline engine, a package registry, monitoring, secrets, and single sign-on. You own the data and the uptime instead of renting each piece from a SaaS vendor.

Which open-source tools make up a self-hosted developer platform in 2026?

A common set is Gitea for git, Woodpecker CI for pipelines, Verdaccio for a private npm registry, Grafana for dashboards, Vault for secrets, and Keycloak for single sign-on. The six cover the whole loop from code commit to running service, and each replaces one paid SaaS slice.

What does each tool in the stack replace?

Gitea replaces the GitHub or GitLab git layer. Woodpecker replaces GitHub Actions or CircleCI minutes. Verdaccio replaces npm's private packages or a hosted artifact registry. Grafana replaces Datadog's dashboards. Vault replaces a hosted secrets manager. Keycloak replaces Okta or Auth0.

What is the best self-hosted GitHub alternative in 2026?

For git hosting, Gitea is the leading self-hosted GitHub alternative in 2026: lightweight, MIT-licensed, and around 55,700 GitHub stars. For a full platform, pair it with Woodpecker CI for pipelines, Verdaccio for a private npm registry, Grafana for dashboards, Vault for secrets, and Keycloak for single sign-on. Together the six replace the parts of GitHub most teams pay for.

How much does a self-hosted CI/CD stack cost?

Run all six managed by DANIAN and it is six apps at €9 each — €54 per month, flat. The equivalent SaaS toolchain for five developers runs from roughly $195 to $510 or more per month, and the usage-priced parts, such as monitoring and secrets, keep climbing as you grow.

Is this cheaper than GitHub?

GitHub Team itself is cheap, at $4 per user. The cost stacks up across the rest of the toolchain: CI overage, a private registry, Datadog, a secrets manager, and Okta's $1,500 yearly minimum. A flat €54 for the managed stack beats that sum for most small teams, and it does not rise with usage.

Does the price go up as my team grows?

No. Each app is a flat €9 per month, regardless of how many developers, hosts, secrets, or build minutes you use. There is no per-seat billing and no usage metering, so the bill stays the same as your team and workload grow.

How many developers do you need before self-hosting pays off?

Often as few as two or three. Per-seat fees, CI overage, and Okta's $1,500 yearly contract minimum stack up quickly, so even a small team can spend more on SaaS than the flat €54 the managed six-tool stack costs.

Is self-hosting your CI/CD stack worth it?

It depends on your team size and what you value. For a small team paying separate per-seat and usage fees, a flat €54 managed stack costs less and keeps source and build data on infrastructure you control. If the GitHub Actions marketplace is central to your workflow, GitHub remains the better fit.

When should I stay on GitHub instead?

Stay on GitHub if your workflow depends on the Actions marketplace, if you want one vendor's bundle and console, or if Copilot and the integration network are central to how you work. That breadth is genuine, and no self-hosted stack matches it. The trade you would be giving up is cost predictability and data control.

Is running six separate services too much to manage?

Run them yourself and yes — you become the platform team, patching, backing up, and being on call for all six. That is the reason we exist. We run the six for €9 each, with patching, daily off-site backups, monitoring, and a human on chat, so you get the ownership without the operational load.

Do I need to hire a DevOps engineer to run this stack?

Not when the stack is managed. We patch the software, apply updates, run daily off-site backups, and monitor uptime for all six tools, so a team with no dedicated platform engineer can still own its toolchain. Running the stack yourself is what would call for that role.

Do I need to know Docker to use this stack?

Not when we run it. We handle the containers, the updates, and the server. You work in the tools themselves — push to Gitea, write a .woodpecker.yml, build a Grafana dashboard. If you self-host the stack instead, then yes, Docker and Linux knowledge are part of the job.

Is a self-hosted CI/CD stack secure?

It can be as secure as the SaaS it replaces. Secrets live in Vault instead of plain-text CI variables, sign-in runs through Keycloak with multi-factor support, and managed instances are patched and backed up daily off-site. You decide which region holds the data.

What kind of support is included?

Every app includes 24/7 monitoring and chat support with a named human, at no extra cost. We patch the software, back it up daily off-site, and step in when something needs a human touch. Resource changes and region switches go through us; most day-to-day work is one click from the dashboard.

Is Woodpecker CI as capable as GitHub Actions?

For most pipelines, yes: build, test, and deploy steps run in Docker and are defined in plain YAML. The honest gap is the marketplace. GitHub Actions has thousands of prebuilt actions; Woodpecker's plugin catalog is far smaller. If your workflow leans on niche marketplace actions, Actions is the easier path.

What is the difference between Woodpecker CI and Drone?

Woodpecker CI is the community fork of Drone, started after Drone's licensing changed. It is licensed Apache 2.0, carries about 6,400 GitHub stars, runs each pipeline step in its own Docker container, and has first-class support for Gitea. Pipelines are defined in a plain .woodpecker.yml file.

Does Gitea support GitHub Actions workflows?

Yes. Gitea ships Gitea Actions, a built-in CI system whose syntax mirrors GitHub Actions. Most existing GitHub Actions workflow files carry over with only minor changes, which makes moving a pipeline to a self-hosted forge far less work.

What is the difference between Gitea and GitLab?

Both are git forges you can self-host. Gitea is lightweight and runs on a small server with low memory. GitLab is heavier and bundles a wider DevOps suite, which costs more to run. For a small team that wants git, reviews, issues, and simple CI, Gitea is the lighter fit.

What is the difference between Gitea and Forgejo?

Both are git forges built from the same codebase. Forgejo launched in late 2022 as a community soft fork, after Gitea moved to a for-profit company structure. It became a fully independent hard fork in early 2024 and later relicensed to GPLv3+. The two stay broadly API-compatible, so Forgejo is a drop-in replacement for most Gitea setups.

Can Gitea host Docker images and other package formats?

Yes. Gitea's built-in package registry stores Docker and OCI container images, npm, Maven, PyPI, NuGet, Helm, Cargo, and more than 20 package formats, all under the same namespace as your repositories. It covers more formats than a single-language registry like Verdaccio.

How does Verdaccio handle public npm packages?

Verdaccio proxies the public npm registry and caches what your builds pull. The first install fetches a package from npm; later installs serve it from your cache, which makes CI faster and more reliable. Your private packages live alongside the cache, and your .npmrc points at one registry for both.

Can this stack handle projects that aren't JavaScript?

Mostly yes. Git, CI pipelines, dashboards, secrets, and single sign-on are all language-agnostic. Verdaccio itself is npm-only, but Gitea's package registry handles Maven, PyPI, NuGet, and Docker, so teams working in other languages are covered without adding a separate product.

Grafana vs Datadog — which should I use?

Grafana is open-source visualization you self-host, and it needs a data source such as Prometheus behind it. Datadog is an all-in-one SaaS that bundles collection, dashboards, APM, and alerting, billed per host. Grafana trades more setup for a far lower bill and data you keep.

How much RAM does Keycloak need?

Keycloak's base configuration wants around 1.25 GB of RAM, and production deployments typically run 2 to 4 GB. It is full identity-and-access management rather than a simple login gate, which is why it is heavier than lightweight single-sign-on tools.

Can these tools do single sign-on together?

Yes — that is Keycloak's job. Put Keycloak in front of Gitea, Woodpecker, Verdaccio, Grafana, and Vault, and your team signs in once to reach all of them. It speaks OpenID Connect, OAuth 2.0, and SAML, so the other tools connect through standard protocols.

Is HashiCorp Vault still open source?

Not in the strict sense. Vault moved to the Business Source License in 2023, which is source-available rather than OSI-approved, and HashiCorp is now owned by IBM. OpenBao is the community fork under the Linux Foundation that keeps a true open-source license and stays API-compatible. We host Vault; OpenBao is the path if the license is a hard requirement.

What is OpenBao and how does it relate to Vault?

OpenBao is the open-source fork of HashiCorp Vault, created in 2023 after Vault moved to the Business Source License. It is licensed MPL 2.0, governed under the Linux Foundation, and stays API-compatible with Vault. It is the path to take if a strictly open-source license is a hard requirement.

Can I migrate from GitHub to Gitea?

Yes. Gitea has a built-in migration tool that imports a repository along with its issues, pull requests, labels, milestones, and releases from GitHub and other forges. You can move one project at a time and check it before bringing the rest across.

Where is my data hosted?

Your application data is hosted in the region you choose, across 21 datacenter regions on six continents. Pick the location closest to your team or your users. Your source, your packages, and your build logs stay on the instance you run, not inside a vendor's multi-tenant SaaS.

What happens to my code and packages if I leave?

They are yours and they are portable. Gitea, Verdaccio, and the rest are standard open-source tools, so you can export your repositories, packages, and configuration and move them anywhere that runs the same software. There is no proprietary format holding your data in place.

Do I get access to the underlying instance?

Yes. You get terminal and file access to your own instance through the dashboard. You can inspect the running container, read logs, and check configuration yourself. We run the patching and backups; you keep full visibility into the software you depend on.

Can I self-host this stack myself on one server?

Yes. If you have a developer in-house, you can run all six on a production-class VPS, and an open-source platform like Coolify makes the orchestration manageable. You trade the flat €54 for a server bill near $24/month plus the hours you spend patching, backing up, and being on call.

Can a two-person team use this stack?

Yes, and it often pays off sooner than people expect. Two developers still hit per-seat fees, CI overage, and Okta's $1,500 yearly minimum. At €9 per app with no seat counting, a small team gets the same tools for a flat, predictable price. Start with git and pipelines, then add the rest.

What to do this week

This week, move one repository to managed Gitea and review a pull request there. Add a single Woodpecker pipeline that builds and deploys it. That pair is €18/month and proves the loop on real work. If it holds, add the registry, dashboards, secrets, and single sign-on as you need them — €9 each, in the region you choose.

You keep your code, your packages, and your build data; we keep the servers patched and backed up. If your team leans on the GitHub Actions marketplace, stay there with a clear conscience. If predictable cost and ownership matter more, the stack above is ready when you are.

See pricing for the full stack.