🚀 Pijul Nest: community package now available

[LoudLemur]

TL;DR: The Nest is the repository hosting platform for Pijul, a version control system built on a theory of patches rather than snapshots. Web UI, accounts, discussions, and push over SSH. Now packaged for Cloudron. Unofficial and community-maintained.

Headline features

• Browse repositories, file trees and changes in a clean terminal-styled web UI
• Per-user accounts with public and private repositories
• Discussions attached to a repository, and change review
• Clone over HTTPS with nothing to configure; push over SSH on a port you pick at install
• Outgoing mail through Cloudron's relay, for password recovery and notifications
• AGPL-3.0-or-later, shipped unmodified from upstream

Why Pijul, if you have not met it

Pijul's patch model is commutative: two changes that do not touch the same lines can be applied in either order and land the same repository, so a change moves between branches without rebasing or cherry-picking. Conflicts still happen when two people genuinely edit the same thing, but they are recorded in the repository rather than resolved and forgotten, so you can revisit how one was settled.

If you have ever wanted Darcs' theory of patches with performance that survives a real repository, this is that.

Links

• Project homepage: https://pijul.org
• Upstream source: https://nest.pijul.com/pijul/nest
• 🧱 Cloudron package: https://github.com/OrcVole/pijul-cloudron
• Store listing: https://ca.cloudron.io/app/pijul-nest

There is no hosted demo. Once installed, the Nest's own web interface is the whole thing.

How to install

The easiest route is the dashboard: open the App Store, click the Add custom app dropdown at the top right, and choose Community app. Paste the versions URL into the box that appears. Apps installed this way receive automatic updates.

https://raw.githubusercontent.com/OrcVole/pijul-cloudron/main/CloudronVersions.json

Or from the CLI:

cloudron install \
  --versions-url https://raw.githubusercontent.com/OrcVole/pijul-cloudron/main/CloudronVersions.json \
  --location pijul.example.com

Minimums: 2 GiB memory limit, though it idles well under a tenth of that. Addons: localstorage, postgresql, sendmail.

Pick an SSH port during install. The Nest serves SSH itself rather than through the system daemon, so it cannot use port 22. Leaving the port disabled still gives you browsing and cloning over HTTPS, but you will not be able to push to the instance at all, so enable it if you want a working remote rather than a read-only mirror.

First run: the Nest has its own account system and does not use Cloudron single sign-on, because upstream provides no OIDC or LDAP to map onto. Register on the instance; the first account you create is yours. Add an SSH key under account settings before pushing.

For users

Good fit if you want to try patch-based version control on your own infrastructure without building the server yourself, or if you already use Pijul and want somewhere to put repositories that is not someone else's hosted service.

Probably not a fit if you need Git compatibility, a mature plugin ecosystem, or CI. Pijul is young software and the Nest is younger; this package is a way to run it, not a claim that it is a drop-in replacement for what you have.

🧰 For packagers: what this one taught me

Upstream's own deployment module was worth more than its README. The Nest ships a NixOS module that generates its production config, and it stated plainly what the README did not: how many services there are, which are optional, what the real defaults are, and which user each runs as. Reading it first killed an invented etcd dependency and a wrong port map before either became work. If an upstream ships a Helm chart, a compose file, or a systemd unit, read that before the README.

A migration can hardcode a role name a managed database cannot create. These migrations grant to a specific role that upstream's own deployment creates first. Cloudron's postgresql addon cannot create roles, so the first migration fails on a name, not a privilege. Rewriting the grantee to CURRENT_USER at build time fixes it and needs no elevated permission at all.

HTTPS here is read-only, by design. I had it documented the other way round for most of a day. The write path lives entirely in the SSH server; the HTTP handler only ever reads. Worth knowing before you promise a user that HTTPS push works.

Something has to make a real request. A duplicated nginx directive killed the front proxy while every process still reported healthy and the container still reported up. Nothing caught it except actually asking the port for a page.

Still open: this storage engine is memory-mapped and commits by overwriting a page in place, guarded by advisory locks that a filesystem-level backup has no reason to take. Whether a backup running during a push can catch a repository mid-write is a real question I could not settle in six attempts, and I would rather say so than imply I proved it safe.

️ For the Cloudron team

Maintenance burden: upstream ships no tagged releases at all, so this package pins an exact point in a moving tree and re-pinning is a deliberate decision rather than a scheduled one. Expect a slower update cadence than most community packages, with more care per update.

Why it might suit the store: Forgejo, Gogs and GitLab are all here and none of them host Pijul repositories, so this covers a gap rather than duplicating a package. The App Wishlist thread for Pijul has been open since 2023 with a few thousand views.

Friction worth knowing: a tcpPorts default value collided with an existing app on first install, and neither the error nor the CLI output named which app held the port or offered a free one. Separately, a half-failed install left a record behind that kept its port reserved, so a straight retry with the same number failed until the stray record was removed.

For Pijul's developers

Two things that would help anyone packaging the Nest, offered with thanks rather than as complaints.

A one-line note at the top of the checked-in api/config.toml saying it is a development config and pointing at the NixOS module would prevent a packager reading it as the deployment contract; the two disagree on nearly every field, including whether etcd is involved at all.

And pijul clone --change <hash> currently panics against the Nest's own repository, deep in a dependency it has just fetched. --state <hash> works and produces the same tree, which is what made pinning a build possible, but --change is the obvious thing to reach for first. Details are in the package repo if useful.

Synergies

Pijul Nest + Forgejo or Gogs: these do not compete. Git repositories stay exactly where they are and Pijul repositories get a home alongside them, so you can try a genuinely different version control model without migrating anything or giving anything up.

Pijul Nest + a wiki such as BookStack or Wiki.js: repository discussions are good for change-level conversation and poor for long-form design documents. Keeping the argument in a wiki and the record of what actually changed in the Nest suits both better than forcing either to do both jobs.

Pijul Nest + Cloudron's own backups: the instance's SSH host key and password material are generated once and live under the app's data directory, so a restore brings back a working instance rather than one every client suddenly distrusts. That is worth more for a version control server than for most apps, because a changed host key looks exactly like an attack.

Feedback, bug reports, and "works on my install" confirmations all welcome.