> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nofire.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Git on Edge Proxy

> Clone GitHub repositories into your cluster for private networks and air-gapped environments

<Note>
  This option is in development. Contact [support@nofire.ai](mailto:support@nofire.ai) to join early access.
</Note>

Edge Proxy Git runs the GitHub integration inside your Kubernetes cluster through NOFire Edge. Repositories are cloned and managed in your environment. Code stays in your infrastructure, except for small snippets sent when needed for investigation.

## When to Use It

* Repositories are private to your network
* You need in-cluster data residency and control
* Repositories are large enough that on-demand API access is too slow
* Your cluster has no outbound internet access

For the fastest setup without running infrastructure, use [GitHub App](/git/github-app).

## Prerequisites

* NOFire Edge deployed in your cluster with the Edge Proxy enabled. See [On-Prem Connections](/edge/on-prem-connections)
* GitHub instance reachable from Edge pods
* Helm available for Edge updates

## Authentication Options

### Option 1: GitHub App (Recommended)

Uses the same GitHub App mechanism as the cloud and self-hosted setups. No PATs to manage or rotate.

**1. Register a GitHub App on your instance**

Log in to your GitHub instance and navigate to **Settings > Developer Settings > GitHub Apps > New GitHub App**.

* **Homepage URL:** `https://nofire.ai`
* Enable the following **Repository Permissions** as Read-only:
  * Contents
  * Commit statuses
  * Deployments
  * Metadata
  * Pull requests

**2. Collect App Credentials**

After creating the app, collect:

* **App ID** — shown on the app's settings page
* **Private Key** — generate and download from the app's settings page
* **Installation ID** — install the app in your organization, then get the ID from the URL: `github.your-company.com/organizations/<org>/settings/installations/<Installation-ID>`

**3. Store the Private Key as a Kubernetes Secret**

```yaml theme={null}
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: github-app-creds
  namespace: nofire-system
stringData:
  privateKey: |
    -----BEGIN RSA PRIVATE KEY-----
    ...
    -----END RSA PRIVATE KEY-----
```

```bash theme={null}
kubectl apply -f github-app-creds.yaml
```

**4. Configure in `values.yaml`**

```yaml theme={null}
onPremConnections:
  github:
    type: githubApp
    url: "https://github.your-company.com"
    secretName: github-app-creds
    appId: "YOUR_APP_ID"
    installationId: "YOUR_INSTALLATION_ID"
    clone:
      enabled: true
      repos:
        - org/repo-one
        - org/repo-two

gitVolume:
  type: persistentVolumeClaim
  persistentVolumeClaim:
    spec:
      accessModes:
        - ReadWriteOnce
      resources:
        requests:
          storage: 50Gi
```

**5. Upgrade the release**

```bash theme={null}
helm upgrade nofire-edge nofire/nofire-edge \
  -f values.yaml \
  -n nofire-system
```

### Option 2: Personal Access Token

**1. Create a token** with `repo` and `read:org` scopes on your GitHub instance.

**2. Store credentials as a Kubernetes Secret**

```bash theme={null}
kubectl create secret generic github-clone-creds \
  --from-literal=token=YOUR_GITHUB_TOKEN \
  -n nofire-system
```

**3. Configure in `values.yaml`**

```yaml theme={null}
onPremConnections:
  github:
    type: github
    url: "https://github.your-company.com"
    secretName: github-clone-creds
    clone:
      enabled: true
      repos:
        - org/repo-one
        - org/repo-two

gitVolume:
  type: persistentVolumeClaim
  persistentVolumeClaim:
    spec:
      accessModes:
        - ReadWriteOnce
      resources:
        requests:
          storage: 50Gi
```

**4. Upgrade the release**

```bash theme={null}
helm upgrade nofire-edge nofire/nofire-edge \
  -f values.yaml \
  -n nofire-system
```

## Storage

Edge clones repositories into `gitVolume`.

**Default (emptyDir)** — ephemeral. Repositories re-clone after every pod restart.

```yaml theme={null}
gitVolume:
  type: emptyDir
  emptyDir:
    sizeLimit: 10Gi
```

**Recommended for production (PVC)** — persistent across restarts, better for large repositories:

```yaml theme={null}
gitVolume:
  type: persistentVolumeClaim
  persistentVolumeClaim:
    spec:
      accessModes:
        - ReadWriteOnce
      resources:
        requests:
          storage: 100Gi
```

Use PVC for production. Use `emptyDir` only when re-cloning after restarts is acceptable.

Plan for total repository size × 1.5 to account for git metadata and growth.

## Troubleshooting

* **Authentication failed.** Token is invalid, expired, or missing `repo` scope. For GitHub App auth, verify App ID and Installation ID are correct.
* **Network timeout.** GitHub instance is not reachable from Edge pods.
* **Disk pressure.** Increase storage in `gitVolume`.
* **Repositories not updating.** Check credentials are current and the host is reachable from the cluster.