Diffinery
Administration: Self-hosting
Docs / Administration

Self-hosting

Diffinery is open source (Apache-2.0) and runs on your own Cloudflare account. What an instance needs, what it costs, the steps to deploy one, and where to go next.

Diffinery is open-source software under the Apache License 2.0, and the way to use it is to run your own instance on your own Cloudflare account and domain. There's no hosted service to sign up for: diffinery.com is the project's own instance. This page is the overview; Deploy your own Diffinery is the step-by-step guide.

Want to try it before you deploy? Request early access to diffinery.com, the project's own instance. Its administrators review requests and email invitations; see Early access.

Get the source

The repository is diffinery.com/codician/diffinery, mirrored to github.com/codician-team/diffinery. Clone either one; both carry the same main branch, with the LICENSE and NOTICE files at the top.

git clone https://github.com/codician-team/diffinery.git
cd diffinery

What an instance needs

RequirementWhy
A Cloudflare account on the Workers Paid plan, with R2 turned onDiffinery uses Workers, Durable Objects with SQLite, D1, R2, Queues, Workflows, Cron Triggers, Email Sending and Containers. Containers need the paid plan.
A domain added to that accountThe instance's hostname, such as git.example.com, is served through a Workers route on that zone.
A Cloudflare Zero Trust organizationCloudflare Access guards /auth/access, the email sign-in the first administrator uses and that lets people recover a lost passkey.
A clone of the repository and somewhere to run the deployYour own machine with Node.js 22, pnpm 10, jq, curl, openssl and Docker, for scripts/setup.sh; or the repository's Deploy workflow, on a forge with GitHub-compatible Actions.

People who use your instance don't need a Cloudflare account; only the deployment does. See What you need for the full list.

The steps

The quickest way is scripts/setup.sh from a clone on your machine: one command checks your tools, API token and zone, then deploys, and running it again updates the instance.

  1. Create a Cloudflare API token with the permissions the deploy needs.

  2. Choose your hostname and first administrators: DIFFINERY_DOMAIN and BOOTSTRAP_ADMINS. You don't edit any code.

  3. Run the deploy:

    CLOUDFLARE_API_TOKEN=... CLOUDFLARE_ACCOUNT_ID=... DIFFINERY_DOMAIN=git.example.com \
      BOOTSTRAP_ADMINS=you@example.com scripts/setup.sh

    Add --dry-run first to check everything without changing anything. See Deploy from your own machine. To deploy from a workflow on every push instead, see Run the Deploy workflow.

  4. Set up email sending and DNS.

  5. Sign in as the first administrator at /auth/access, add a passkey, and invite your team from Settings → People and invitations.

The deploy creates whatever is missing in your account, applies the database migrations, uploads the Worker and builds the runner image, and every step is safe to repeat. To update later, bring your copy up to date with upstream and deploy again; see Updating.

What it costs

Diffinery is free. Your instance's costs are your Cloudflare bill: the Workers Paid plan has "a minimum cost of $5 USD per month per account", plus usage above its allowances (Workers pricing, checked October 25, 2026), and runner and sandbox containers are billed by the 10 ms while they run (Containers pricing, checked October 25, 2026). Diffinery starts a container only when a job starts and stops it when the job ends, and per-account quotas, which you set, cap what each account can use.

After the first deploy

  • Who can join. An instance is invite-only by default. Set SIGNUP=open to let anyone create an account; see SIGNUP and Invitations.
  • Limits. Change the per-account quotas and the instance's hosted job limit with the QUOTA_* and HOSTED_JOBS_LIMIT variables; see Configuration.
  • Running it. Site administration covers accounts, early access requests, email and audits, and the status page shows whether each part of your instance works.
  • Your team's tools. The CLI, the Claude Code and Codex plugins, the MCP server and the editor extensions all work with your instance. People install the CLI from it and run diffinery setup with its URL, which signs them in and points git, gh, the Claude Code plugins and Codex at it: curl -fsSL https://git.example.com/install | bash, then diffinery setup --url https://git.example.com. AI apps connect to https://git.example.com/mcp. See Claude Code, Codex, Clone in your editor and Clone in JetBrains IDEs.
  • How it fits together. Architecture maps each part of Diffinery to the Cloudflare product that runs it.

Get help and contribute

Report bugs and send pull requests on the GitHub mirror or the Diffinery repository. Report security problems privately with the report form; see Vulnerability disclosure.