Getting started

amadan is git hosting where the server can't read your code. It looks and works like the hosting you already know — clone, push, browse, branches, discussions, CI — with one rule underneath it: if the server is compromised, the attacker gets nothing.

That rule is absolute on one of the three repo tiers and honestly labelled on the other two. Nothing here pretends "private" means "encrypted".

What you need#

For a public or private repo: nothing but git. No install, no plugin, no account on anything but the hub.

For an end-to-end encrypted repo: the amadan CLI and a registered key. Your machine does the encrypting, so your machine has to be in the loop.

Sign in#

amadan has no passwords of its own. Sign-in goes through Keymail, which vouches for an email address you control. Click Sign in with Keymail, and you come back holding a session.

There is no separate amadan account to create, and no password for anyone to leak.

Claim a namespace#

A namespace is the {ns} in /{ns}/{repo} — your personal handle or an organisation's. You get one prompted at you on first sign-in; you can create more from the + menu at any time.

Namespaces can be renamed later without breaking anything. The old name keeps redirecting until somebody else claims it, because a repo's identity internally is a number, not its name.

Create a repo#

From the web: the + menu, then New repo. Pick a tier — the page states what the server can and cannot read for each one, which is the only honest way to present that choice.

From the CLI:

amadan repo create <ns>/<repo> -tier public|private|private_e2ee

The tier defaults to private if you leave it off. See Tiers and encryption for what each one actually means.

Clone it#

A public repo needs nothing:

git clone https://amadan.net/<ns>/<repo>

A private repo needs a token as the git password. Mint one from Settings → Tokens in the web UI, or:

amadan tokens create -label laptop

The token is shown once. The username git asks for is ignored; paste the token as the password.

git clone https://amadan.net/<ns>/<repo>

An end-to-end encrypted repo needs the CLI, a key, and the amadan:: URL scheme:

amadan keygen
amadan auth login -hub https://amadan.net
git clone amadan::https://amadan.net/<ns>/<repo>

amadan keygen mints a local identity in ~/.amadan/key. That key never leaves your machine, and the server never has a copy — which is exactly why the server cannot read the repo.

Where to go next#

• The CLI — installing it, and every command it has.
• Branches, not pull requests — the biggest difference from GitHub, and the one worth reading before you file a bug about a missing button.
• CI — one command, no YAML.
• Tiers and encryption — what the server can read, per tier, stated plainly.
• Self-hosting — running your own hub.
• Agents and the prompt ledger — disclosed AI collaborators, and a record of what they were asked.