Self-Hosted Middleware: DORA Metrics From Your Git Data

Your standup asks why deploys feel slow. Leadership wants DORA numbers for the board deck. Someone exports GitHub stats to a spreadsheet every Friday and calls it DevOps.

Middleware (from Middleware HQ) is the open-source answer aimed at engineering managers, not just SRE dashboards. ~1.6k GitHub stars, Apache-2.0, built around the four DORA metrics: deployment frequency, lead time for changes, mean time to restore, and change failure rate. Connect your Git provider, point it at the repos that matter, and get charts without standing up a data warehouse first.

What it actually does

Middleware pulls engineering signals — primarily pull requests, plus deployments and incidents when you wire them — and turns them into team-level DORA views. The OSS product can start from PR data alone, which lowers the bar if you do not yet have perfect deployment tracking in every pipeline.

Typical workflow:

• Self-host or run locally, open the web UI (default port 3333).
• Add a personal access token from GitHub (or your supported code host).
• Create a team, select repositories, tune filters (prod branch, excluded PRs, incident rules).
• Read dashboards and reports; adjust settings until the numbers match how your org actually ships.

Under the hood the stack is a web frontend, Python Flask services (analytics on 9696, sync on 9697), Postgres, and Redis. The quick-start path is one Docker image (middlewareeng/middleware:latest) with named volumes for Postgres data and encryption keys — not a single static binary, but one docker run gets you going.

Integrations with CI/CD and project tools are on the roadmap and product surface; the OSS docs emphasize transparent calculation rules so you can argue about metrics with data, not vibes.

Why self-host?

Repo metadata is sensitive. PR titles, authors, merge times, and incident links describe how your company builds software. Keeping Middleware on a Canadian VPS or private VLAN avoids exporting that narrative to another vendor's multi-tenant SaaS.

Align metrics with reality. DORA only helps when branch names, deployment definitions, and incident sources match your process. Self-hosting lets you iterate on filters and integrations without waiting on a cloud feature flag.

Cost at scale. Hosted engineering analytics can charge per contributor. A Docker host plus backups is boring accounting — good for bootstrapped teams and agencies with many client repos (each with careful token scope).

Apache-2.0. Fork-friendly if you need internal tweaks; still read what you connect — PAT tokens deserve least privilege and rotation.

What running it takes

Production-style quick start (from upstream README):

• Docker with volumes middleware_postgres_data and middleware_keys.
• Publish 3333 (UI) and optionally 9696/9697 if you split services in dev.
• Watch docker logs until services settle; upgrade via docker pull and recreate the container.

Local development wants serious RAM (16 GB noted upstream). Production for a small eng org is lighter than the full dev compose, but still plan disk for Postgres and backup both volumes before upgrades.

Put TLS and SSO in front if the dashboard is not VPN-only. Treat PATs like production secrets; Middleware stores team configuration in your database, not in someone else's account.

Who it's for (and who should skip it)

Good fit: engineering leads at 5–100 developer shops, platform teams formalizing delivery metrics, consultancies measuring client delivery after migrating to GitHub, orgs preparing for SOC/ISO conversations that ask "how do you measure change risk?"

Maybe skip it: if you have no consistent Git workflow, DORA will lie politely. If you already live in Jellyfish/LinearB/Sleuth and love it, duplicating Middleware adds ops. Solo hackers with one repo rarely need a DORA platform — a CI badge suffices.

Hosting it in Canada

Middleware fits a Docker or VPS footprint next to your internal tools: private hostname, nightly Postgres volume backups, outbound HTTPS only to GitHub/GitLab APIs you authorize.

Tell us team size, which Git host you use, and whether deploy/incident data lives in CI yet if you want a sizing sanity check before you paste org-wide PATs into a new dashboard.

Want DORA without shipping your engineering story to the default cloud? Talk with Swift Host — we are in St. Albert and actually answer the phone.