Generated 2026-04-08

Context: git-proxy is a FINOS project that acts as a policy-enforcing proxy for git pushes. The current implementation is Node.js/Express. This document compares the server-side capabilities relevant to building a store-and-forward git proxy — where pushes land in a local repository first, run through validation hooks with real-time sideband feedback, then get forwarded upstream.

These findings come from prototyping git-proxy-java, a Java/Jetty implementation that uses JGit's native git protocol stack.

A git proxy that does more than passively forward bytes needs to:

Quick reference for integrating JGit's server-side git-receive-pack handling into jgit-proxy's servlet-based filter architecture.

GitServlet (HTTP layer)
  ├── RepositoryResolver<HttpServletRequest>  ← "which repo?"
  ├── ReceivePackFactory<HttpServletRequest>   ← "how to handle this push?"

finos/git-proxy is the upstream reference — a Node.js/Express server that inspects git pushes and enforces policy. It works. But the stack imposes real constraints on what kind of proxy it can become.

The root problem: express-http-proxy is a dumb TCP relay. It forwards bytes. It has no understanding of the git smart HTTP protocol, no ability to intercept sideband channels, and no mechanism to stream real-time feedback to the developer during a push. The git smart HTTP protocol is stateful and streaming — not a typical request-response exchange.

Building a policy-enforcing proxy in Node requires:

Related issue: finos/git-proxy#1483

gitGraph
   commit id: "feat: foo"
 commit id: "feat: bar"

Git-proxy includes a REST-based API for managing certain aspects of repositories & git operations (pushes, pulls). This API is fronted by a web UI. The web interface is under active development and is missing some key features to allow Git Proxy to push commits through it.

The below procedure will allow you to "authorize" a push through git-proxy using the included API. The following assumptions are made and must be modified to match your deployment of git-proxy:

• Both the proxy & API server is running. This is the default behaviour.
• git-proxy is running on localhost on ports 8000 (proxy) and 8080 (API)
• The instructions from the quick start have been followed. This includes modifying the configuration to add a new repository to the authorisedList. For this doc, we assume the upstream repository is https://github.com/RBC/git-proxy.