Architecture

fogwall is a Git push proxy that sits between developers and upstream Git hosting providers (GitHub, GitLab, Bitbucket, Forgejo, etc.). Every push travels through a validation and approval pipeline before reaching the upstream remote. Fetch/clone traffic is audited but not blocked.

If you’re familiar with finos/git-proxy, the Java rewrite shares the same conceptual model: an ordered chain of steps that inspect and act on each push, a push store for audit and approval state, and pluggable providers for different Git hosts. The main structural difference is that fogwall offers two distinct proxy modes with different tradeoffs.

Contents

• Project structure — the Gradle modules and how they depend on each other
• Two proxy modes — server mode, transparent proxy, and the SCM API listeners
• Request flow — what happens to a push, step by step, in each mode
• Validation pipeline — the ordered chain of checks a push runs through
• Core abstractions — provider, push store, approval gateway, user store
• Deployment modes — proxy only, proxy plus dashboard, and Docker
• Advanced use cases — private-to-private proxying and credential rewriting
• What this architecture enables — the use cases server mode’s full pack ownership opens up