Open-source CI/CD stack for dev teams in 2026

A small engineering team can run its whole development toolchain on six open-source tools: git, pipelines, a private registry, dashboards, secrets, and single sign-on. You give up GitHub's ecosystem; you keep ownership of your code, your build data, and a cost that does not move when your team grows.

• The stack: Gitea for git, Woodpecker CI for pipelines, Verdaccio for a private npm registry, Grafana for dashboards, Vault for secrets, and Keycloak for single sign-on.

• Run all six managed by us and the math is flat: 6 × €9 = €54/month, in the region you choose, across 21 datacenter regions on six continents.

• The equivalent SaaS toolchain — GitHub seats, CI minutes, a private registry, Datadog, a hosted secrets manager, and Okta — runs from roughly $195 to $510 or more per month at five developers, and climbs with every seat, host, and secret.

• The honest trade: GitHub's Actions marketplace and integrations are unmatched. Self-hosting swaps that breadth for cost you can predict and data you control.

• Start with two tools, not six. Put git on Gitea, wire one pipeline in Woodpecker, and evaluate for 14 days.

Who this stack is for (and who should stay on GitHub)

This list is for a small engineering team — say two to ten developers — that already pays for several developer tools separately and wants fewer invoices and more control. It is not for teams that lean on the GitHub Actions marketplace or want everything inside one vendor's bundle. For those teams, GitHub is the better choice.

GitHub's ecosystem is the reason most teams never leave. The Actions marketplace has thousands of prebuilt steps. Copilot sits in the editor. The integrations are everywhere, and most of the world's developers already have an account. Self-hosting trades that gravity for three things: a cost that does not scale with seats, source and build artifacts that stay on infrastructure you control, and no per-tool price creep.

If the marketplace breadth is load-bearing for your workflow, stay where you are. If predictable cost and data control matter more, the six tools below cover the whole loop.

The six tools, and what each one replaces

Each tool below does one job and replaces one paid SaaS slice. We host every one at €9 per app, per month, patched and backed up daily off-site, in the region you pick. The capsules name the license, the GitHub stars, what the tool replaces, and the one thing it does not do well.

Gitea — your git hosting

Gitea is a self-hosted git forge: repositories, pull requests, code review, issues, a kanban board, and a built-in package registry. It is written in Go, licensed MIT, and carries about 55,700 GitHub stars. It runs on a small server and starts in seconds. For most teams it covers what GitHub's core does: hosting code, reviewing pull requests, tracking issues, and tagging releases. Gitea also ships Gitea Actions, a built-in CI system whose syntax mirrors GitHub Actions, so existing workflow files mostly carry over.

The honest limit is community size. GitHub has the world's developers and an integration for nearly everything. Gitea's third-party surface is smaller. The community split in late 2022 when the Forgejo fork launched over governance concerns, and Forgejo became a fully independent project in early 2024. Both projects are healthy, but neither has GitHub's gravity. If your work depends on a long list of GitHub-only integrations, that gap is real.

We run managed Gitea for git hosting at €9/month. We patch it, back it up daily off-site, and keep it monitored. You push code; you do not run the server.

Woodpecker CI — your pipelines

Woodpecker CI runs your build and deploy pipelines. It is a community fork of Drone, licensed Apache 2.0, with about 6,400 GitHub stars. Every pipeline step runs in its own Docker container, and the server idles at roughly 100 MB of RAM. Pipelines are defined in a plain .woodpecker.yml file, and Woodpecker has first-class support for Gitea, so the git host and the CI engine fit together without glue code. A push to Gitea triggers a run; the run builds, tests, and deploys.

The honest limit is the plugin ecosystem. GitHub Actions has a marketplace with thousands of prebuilt actions, and that breadth is hard to match. Woodpecker's plugin catalog is far smaller, though Drone plugins are compatible and most build steps are a few shell commands anyway. Setup also asks more of you than a hosted runner: TLS, OAuth, and a reverse proxy. Self-hosted CI means someone owns the uptime.

That someone is us. We run Woodpecker CI for pipelines at €9/month, wired to your Gitea instance, patched and monitored. When a runner needs attention, a human engineer handles it.

Verdaccio — your private npm registry

Verdaccio is a private npm registry. It stores your internal packages and proxies the public npm registry, caching what your builds download. It is licensed MIT, carries about 17,700 GitHub stars, boots in seconds, and is fast enough to sit inside CI — many open-source projects use it for end-to-end tests. Point a project's .npmrc at Verdaccio and your private packages install exactly like public ones, without publishing your code to the public registry.

The honest limit is scope and staffing. Verdaccio is built for npm; it is not a multi-format artifact platform, so a team needing Maven, PyPI, and Docker in one place will outgrow it. It is also volunteer-maintained, with no full-time team and, by the maintainers' own note, no current funding for security research. The project is active and widely used, but it is community software, not a vendor product.

We run managed Verdaccio at €9/month, patched and backed up. Your private packages and your cache live on infrastructure you control, not inside a registry seat plan that bills per developer.

Grafana — your dashboards

Grafana turns metrics, logs, and traces into dashboards and alerts. It connects to more than 150 data sources, including Prometheus, Loki, and Postgres, and it is the most widely used open-source tool for the job. Grafana is licensed AGPLv3 — it moved from Apache 2.0 in 2021 — and carries more than 60,000 GitHub stars. You watch your deploys, your error rates, and your build health on one screen, and you set alerts when something crosses a line.

The honest limit is that Grafana is the visualization layer, not the whole observability stack. It needs a data source behind it — usually Prometheus for metrics — and that is a separate thing to run. Datadog bundles collection, dashboards, APM, and alerting into one product that works out of the box; Grafana asks you to assemble more pieces, and its query languages take time to learn. The trade is cost and control: Grafana plus Prometheus runs for a fraction of Datadog's per-host bill.

We run Grafana for dashboards at €9/month, patched and monitored, in the region you choose. The data stays yours.

Vault — your secrets

Vault stores and manages secrets: API keys, database passwords, certificates, and encryption keys. It hands secrets to your pipelines and apps at runtime, so credentials never sit in plain text in a repo or a CI variable. It records which client read which secret and when. Vault carries about 35,700 GitHub stars and is the most established tool in its category.

One honest point matters here. Vault is no longer open source in the strict sense. In 2023 its maker moved it to the Business Source License, which is source-available rather than OSI-approved; HashiCorp is now owned by IBM. The community responded with OpenBao, a fork under the Linux Foundation that keeps the MPL 2.0 open-source license and stays API-compatible. If a strictly open-source license is a hard requirement, OpenBao is the path; if you want the established tool, Vault is it. The other honest limit is operational weight: initialization, unsealing, and high availability are not trivial, and Vault ships security fixes almost monthly.

We run managed Vault at €9/month and carry that operational weight — the unseal flow, the patching, the backups — so your team does not.

Keycloak — one login across the toolchain

Keycloak is identity and single sign-on. It speaks OpenID Connect, OAuth 2.0, and SAML, connects to LDAP and Active Directory, and supports multi-factor login. Wire it in front of the other five tools and your team signs in once to reach Gitea, Woodpecker, Verdaccio, Grafana, and Vault. Keycloak began at Red Hat, is a CNCF project, is licensed Apache 2.0, and carries about 34,700 GitHub stars.

The honest limit is weight and complexity. Keycloak is full identity-and-access management, and it shows: the base configuration wants around 1.25 GB of RAM, and production deployments typically run 2 to 4 GB. Lighter single-sign-on tools exist if all you need is a login gate. Keycloak also ships frequent security patches that have to be applied promptly. Okta and Auth0 hide all of this behind a hosted console — that polish is what their per-user price buys.

We run managed Keycloak at €9/month and keep it patched. Your team gets one login across the stack; you do not run the identity server or chase its security releases.

How the six fit together

The six tools form one loop. A developer pushes code to Gitea. The push triggers a Woodpecker pipeline. The pipeline pulls dependencies from Verdaccio, builds, and deploys. You watch the result in Grafana. Vault hands each step the secrets it needs, and Keycloak gives the whole team one login across all six.

In practice it reads like this. A developer opens a pull request in Gitea and a teammate reviews it. On merge, Woodpecker starts a run defined in .woodpecker.yml. The run installs packages from Verdaccio — private ones you published, public ones it cached — then runs tests and ships the build. Throughout, the pipeline asks Vault for the database password and the deploy key rather than reading them from a file. After deploy, a Grafana dashboard shows error rates and response times, with an alert set for regressions. Everyone reached every tool through a single Keycloak login. No part of that loop sent your source, your packages, or your build logs to a vendor you do not control.

What the stack costs

Run all six with us and the math is simple: six apps at €9 each is €54 per month, flat, no matter how many developers, hosts, secrets, or build minutes you use. The equivalent SaaS toolchain at five developers runs from roughly $195 to $510 or more per month — and the number rises as you grow.

A few honest caveats sit behind that table. GitHub bundles some of these jobs — Actions for CI, Packages for a registry — so a GitHub-centric team may not buy every line separately. The SaaS figures are list prices in US dollars; real bills vary with usage and negotiated discounts. Datadog and the secrets managers are usage-priced, so their cost climbs with hosts and secret counts rather than seats. Okta's $1,500 annual minimum means even a three-person team pays a four-figure floor.

The pattern holds at any reasonable exchange rate: a flat €54 beats a usage-metered toolchain that starts near $200 and only grows. We do not bill per developer, and we will not raise your price because your team grew.

Start a 7-day free trial — no card needed.

How to start

Do not stand up six services at once. Start with two. Put your git on Gitea and wire one pipeline in Woodpecker, then run that pair for 14 days against real work. If it holds, add the registry, dashboards, secrets, and single sign-on one at a time.

A sensible order is git first, then CI, then the rest as you feel the need. Move one repository to Gitea and review a few pull requests there. Add a .woodpecker.yml to that repo and let one pipeline build and deploy. Once that loop is steady, point your .npmrc at Verdaccio, then add a Grafana dashboard for the service you just shipped. Bring in Vault when you want secrets out of CI variables, and Keycloak when one login across the tools starts to matter. Each tool is €9/month on its own, so you grow the stack at your own pace.

See how managed Gitea works.

Frequently asked questions

What is a self-hosted CI/CD stack?

It is the set of tools a team runs on its own infrastructure to write, build, and ship software: git hosting, a pipeline engine, a package registry, monitoring, secrets, and single sign-on. You own the data and the uptime instead of renting each piece from a SaaS vendor.

Which open-source tools make up a self-hosted developer platform in 2026?

A common set is Gitea for git, Woodpecker CI for pipelines, Verdaccio for a private npm registry, Grafana for dashboards, Vault for secrets, and Keycloak for single sign-on. The six cover the whole loop from code commit to running service, and each replaces one paid SaaS slice.

What does each tool in the stack replace?

Gitea replaces the GitHub or GitLab git layer. Woodpecker replaces GitHub Actions or CircleCI minutes. Verdaccio replaces npm's private packages or a hosted artifact registry. Grafana replaces Datadog's dashboards. Vault replaces a hosted secrets manager. Keycloak replaces Okta or Auth0.

What is the best self-hosted GitHub alternative in 2026?

For git hosting, Gitea is the leading self-hosted GitHub alternativeyFd7KDA"] .zpicon-common svg{ fill:#0F4C5C !important }

Custom Domains