We're considering moving away from our Atlassian setup because we need to remain fully on-premises and cannot adopt a cloud-only platform. GitLab is the obvious option, but I'd prefer to understand the trade-offs before committing.
Open-source tools such as Forgejo and Gitea are appealing, especially for source control, but I'm unsure how well they handle a more complete development workflow. In particular, we need CI, test reports, SAST and SCA results, and a way to surface tools such as OpenGrep findings directly in pull or merge requests.
For those running an on-prem or air-gapped environment, what does your toolchain look like? Do you use GitLab as an all-in-one platform, combine Forgejo or Gitea with a separate CI provider, or assemble several dedicated security and project-management tools? Ease of operation, reporting, high availability, disaster recovery, and maintenance are all important considerations.
5 Answers
GitLab is probably the safest choice when you need an integrated, company-ready platform. The Community Edition is worth evaluating first, and it can be brought up fairly quickly with a container setup and a runner. It includes reusable CI templates for SAST, DAST, dependency scanning, secret detection, and similar jobs, so you don't have to wire every report into the forge yourself. The trade-off is that GitLab is comparatively heavy, and you'll need to plan carefully for maintenance, backups, disaster recovery, and possibly high availability.
The source forge and CI system do not have to be the same product. You could use Forgejo or Gitea for repositories and pair it with a dedicated CI platform such as Buildkite or another on-prem runner system. Security scanners and quality tools can then publish artifacts or status checks independently. This gives you more flexibility and keeps the forge lightweight, but it also means owning the integrations that GitLab provides out of the box.
Forgejo and Gitea are excellent lightweight Git servers and can work well for smaller developer-focused environments. Their Actions are broadly compatible with GitHub-style workflows, but the experience can become awkward once you need polished test-report views, security findings in merge requests, and other integrated reporting. For personal projects or a small team, that may be a reasonable trade-off; for a regulated organization replacing a larger collaboration suite, GitLab generally involves less integration work.
A practical approach would be to run GitLab CE in a test environment for a month and reproduce your real workflow: build pipelines, OpenGrep output, dependency scanning, test reports, and merge-request feedback. If the built-in reporting covers the requirements, the extra resource usage may be worthwhile. If it feels excessive, you can compare a lightweight forge plus external CI and security services using the same tests rather than evaluating them only by their Git interface.
If you want a close replacement for a broad Atlassian-style setup, GitLab is the most straightforward all-in-one candidate. If you only need Git hosting and a small number of CI jobs, Gitea or Forgejo may be enough. Project-management replacement is a separate question, though; tools such as Plane may be worth evaluating for that part of the stack. Also check deployment architecture early, since GitLab can be easier to run on virtual machines than in some Kubernetes setups.
That matches what I've seen so far. The basic Git and Actions functionality is appealing, but the effort needed to expose SAST results and test reports in the review workflow is my main concern.