Over the last years I noticed that release distribution often becomes messy much earlier than expected. As long as everything is public, a GitHub release or an S3 bucket is usually enough. The moment you need slightly different access rules, things start to break down.
One customer should get build A but not build B. Another one should only download artifacts for a limited time. CI pipelines need access, but you do not want to hand out long-lived credentials. What often follows is a combination of spreadsheets, ad-hoc scripts, bucket policies and a growing fear of breaking something that already works.
I started building Releasy to address exactly this gap.
Releasy is an open source, self-hosted backend that sits in front of your release artifacts and decides who can access what. It does not try to be a licensing SDK, a payment system or a hosted SaaS. It focuses purely on controlled access to releases and downloads, with infrastructure you own and operate yourself.
The core idea is simple. You publish releases, attach artifacts to them, and grant access via short-lived download tokens or API keys with explicit scopes. A client, a CI job or a customer never talks to your object storage directly. Instead, Releasy validates permissions and issues time-limited access when a download is requested.
Everything runs as a single Rust service backed by PostgreSQL. It can be deployed on one machine for small setups or split across multiple hosts if needed. Authentication is handled via API keys and optional JWT integration, but it also works without any external identity provider if you want to keep things minimal.
Releasy is fully self-hosted by design. There is no central service, no call-home behavior and no dependency on a vendor backend. If you can run Docker and PostgreSQL, you can run Releasy. The full source code, deployment playbooks and documentation are available publicly.
This project grew out of a real need in my own work, and I am sharing it in case others are facing similar problems with release distribution and access control. It is still evolving, but already usable for real setups.
If this sounds relevant to you, you can find the repository and documentation here:
https://github.com/releasyhq/releasy
Feedback, questions and critical perspectives are very welcome.
Top comments (0)