Encrypted Git repository backups.
xbackupman mirror-clones every repository under a GitHub, GitLab or Gitea account — code, branches, tags and all — into one encrypted archive stored in a bucket you own. A read-scoped access token is all it needs.
What gets captured
- Every repository the token can see under a user, organization or group — private repos included.
- A full --mirror clone of each repo: all branches, tags and refs, not just the default branch.
- The bare repositories tarred together, gzipped and sealed with AES-256-GCM inside the worker.
- A SHA-256 checksum per snapshot so you can prove the archive is intact.
How it works
Add a token
Paste a read-scoped Personal Access Token for GitHub, GitLab or Gitea (self-hosted instances supported via a base URL). It is encrypted with your organization key.
List and mirror-clone
The worker lists every repository via the provider's API, then git clone --mirror pulls each one with all branches and tags. The token is passed to git off the process list.
Archive, encrypt, upload
The bare repos are tarred, gzipped and sealed with AES-256-GCM in the worker, then the ciphertext is uploaded to your own S3-compatible bucket.
Verify and schedule
Each archive is SHA-256 checksummed. Run it nightly and let retention prune old snapshots while always keeping the latest.
Your storage, your keys
Your repository archives are written to your own bucket — S3, R2, B2 or MinIO. Encryption happens in the worker before upload, so your provider only ever holds ciphertext. Your source code stays fully in your custody.
xbackupman never stores your backups on its own servers. It orchestrates the pipeline and records metadata — the encrypted artifacts live only in the S3-compatible bucket you connect. See how encryption works.
One-click restore
A Git backup is a tar of bare --mirror clones. Download and unpack the archive, then push any repository back to a host with git push --mirror. Because every ref is captured, the restored repository is a faithful copy — a lifeline if an account is lost, suspended or compromised.
Questions
QWhich git hosts are supported?
GitHub, GitLab and Gitea — including self-hosted GitLab/Gitea and GitHub Enterprise via a base URL. One token backs up every repo under a user, org or group.
QAre private repositories included?
Yes. Every repository the access token can read is mirrored, private ones included. Use a least-privilege read-only token.
QDoes it capture all branches and tags?
Yes. Each repo is cloned with --mirror, which captures every branch, tag and ref — a complete copy, not just the default branch.
Back up more
One engine covers every source you run — on a single schedule, in one dashboard, encrypted into the same storage.