anchor-lfs

README

Anchor LFS

A lightweight, standalone Git LFS server written in Go that authenticates users against their GitHub repository permissions.

Features

• Full Git LFS Batch API compliance
• File locking API for coordinating concurrent edits
• GitHub-based authentication (checks pull/push permissions on your repo)
• Multiple repository endpoints from a single instance
• Local filesystem or S3-compatible object storage (AWS S3, Cloudflare R2, MinIO, etc.)
• HMAC-signed transfer URLs with configurable expiration
• SHA-256 integrity verification on upload
• Configurable per-endpoint visibility (public/private)
• Per-IP rate limiting on the batch and lock API
• Optional Prometheus metrics on a separate port
• Docker-first deployment

Quick Start

Docker

cp config.toml.example config.toml
# Linux hosts only: the container runs as uid 100, gid 101 and must be able to write ./data
mkdir -p data && sudo chown 100:101 data
# Edit config.toml with your endpoints, then:
docker compose up -d

This runs the published image ghcr.io/refringe/anchor-lfs:latest. See the Docker wiki page for release tags and building your own image.

Release Binary

Each release attaches archives for Linux, macOS and Windows (amd64 and arm64) with checksums and build attestations. See Installation for how to verify them.

From Source

Requires Go 1.27 or later.

# Build
make build

# Copy config.toml.example, edit it with your endpoints, then run:
cp config.toml.example config.toml
./bin/anchor-lfs

Documentation

Full documentation is available on the Wiki:

• Installation: Building from source and system requirements
• Docker: Container deployment with Docker Compose
• Configuration: All global options, endpoints, and environment variables
• Storage Backends: Local filesystem and S3-compatible storage setup
• Authentication: GitHub and GitHub Enterprise authentication
• Git LFS Client Setup: Configuring your Git client
• File Locking: Coordinating concurrent edits
• Reverse Proxy: Running behind nginx, Caddy, or Traefik
• Security: Security model and best practices
• Operations: Backups, upgrades, key rotation and storage migration
• API Reference: Endpoint routes and protocol details
• Troubleshooting: Common issues and solutions

Development

make build        # Compile binary to bin/anchor-lfs
make run          # Build and run
make test         # Run tests with race detector
make test-cover   # Run tests with coverage report
make lint         # Run golangci-lint
make fmt          # Format Go code
make prettier     # Format JSON and YAML
make vet          # Run go vet
make vulncheck    # Vulnerability scan
make check        # Run all checks (fmt, prettier, lint, vet, vulncheck, test)
make tidy         # Run go mod tidy
make clean        # Remove build artefacts

Docker commands:

make docker-build   # Build a local anchor-lfs image
make docker-up      # Start containers
make docker-down    # Stop containers
make docker-logs    # Tail container logs

See CONTRIBUTING.md for details.

License

AGPL-3.0