> ## Documentation Index > Fetch the complete documentation index at: https://docs.weaveos.com/llms.txt > Use this file to discover all available pages before exploring further. # GitHub Enterprise Server > Connect a GitHub organization on your own Server using a private GitHub App GitHub Enterprise Cloud organizations on **github.com** use the existing [GitHub connection](/code-platforms/github). Enterprises on a **GHE.com** subdomain (GitHub Enterprise Cloud with data residency) use the [GHE.com connection](/code-platforms/github-enterprise-cloud-data-residency); Weave sends `*.ghe.com` addresses entered here to that option. A GitHub Enterprise Server organization uses a private App registered on that Server. Each organization has its own App and credentials. Server connections are enabled for individual Weave organizations and require validation against your exact GHES release. An administrator must confirm network access and source-data handling before enabling the integration. There is no published minimum supported release until appliance validation is complete. ## Connect an organization 1. In Weave's GitHub connection settings, select **GitHub Enterprise Server**. 2. Enter your organization URL, including an HTTPS port if needed, such as `https://github.example.com:8443/engineering`. Weave checks HTTPS connectivity before opening App setup. 3. On GitHub, approve creation of the private Weave App. 4. Install that App in its owning organization and select repository access in GitHub. 5. Return to Weave to see the verified connection and repository discovery status. You need permission to manage Weave connections and to create/install Apps in the GitHub organization. No GHES user OAuth, copied private key, or second repository selection is required during initial setup. Weave sign-in remains unchanged. Requests requiring GitHub administrator approval stay pending until approved. An installation with no repositories remains visible. Grant repository access in GitHub and refresh the connection to begin importing. Installing an App on an enterprise account is not a substitute for an organization installation with repository access. ## Imported data The integration uses Weave's repository pipeline for commits, pull requests, reviews, comments, changed files, repository memberships and enabled GitHub Actions data. Existing exclusions, history windows, contributor matching, and source retention settings apply. Cloud Copilot billing and verified-domain email enrichment remain github.com features. A GHES connection does not grant Cloud billing or Cloud user access. ## Access and network requirements The private App requests read access to repository metadata, contents, pull requests, issues, administration, Actions, checks and deployments, plus organization members. It subscribes to repository, push, pull request, review, comment, organization membership, team, workflow, check and deployment events. Weave verifies the App and installation belong to the intended organization. All API, webhook-processing, sync and clone workers need the same `EXTERNAL_KEY_ENCRYPTION_KEY`. Generate it using the existing deployment encryption-key procedure; retain it securely through restarts and upgrades. Losing the key requires reconnecting Apps. Credentials are encrypted separately for each Weave tenant and connection. **Weave Cloud:** expose the Server's HTTPS address and port to the internet, with your firewall allowing [Weave's outbound IP addresses](/data-sources/reference#ip-addresses). Enter that address in the connection flow. No Weave network environment variable is required. **Self-hosted Weave:** if the Server must remain entirely private, run Weave inside your network. Enter its reachable hostname or private IP, port and organization, such as `https://10.23.0.8:8443/engineering`. Self-hosted deployments allow private addresses directly; no CIDR allowlist or additional network environment variable is needed. Loopback, link-local and metadata addresses remain unavailable. Your browser must reach the Server to approve App creation and installation. Weave workers must reach its API and Git endpoints through direct HTTPS, and the Server must reach Weave's webhook URL. Webhook delivery is required for the GHES integration to function. The initial connectivity check covers the API server's access; repository discovery, clone access and webhook delivery are verified separately during operation. Redirecting gateways and HTTP proxies are not supported for Server credential traffic. TLS verification remains enabled: the certificate must cover the hostname or IP you enter. For a private GHES CA, install its root certificate in each container that makes GHES API or Git requests. Alternatively, mount the CA bundle into those containers and set `SSL_CERT_FILE` to its path. The standard self-hosted Compose configuration does not mount a custom CA bundle or pass `SSL_CERT_FILE`; adding it to the host environment alone is not sufficient. GHES must separately trust the certificate Weave presents on its webhook endpoint. New setup is enabled for individual Weave organizations. Weave Cloud uses the organization-targeted `github-enterprise-server` feature flag; it defaults to unavailable when the flag cannot be resolved and is never automatically enabled by environment. Self-hosted Weave does not need PostHog for this: like other self-hosted features, access ships in the Weave release for named organizations only, so contact Weave to enable your organization. Removing an organization from the rollout blocks new setup without disconnecting saved connections, which keep their maintenance and disconnect controls. If your GitHub organization is renamed before its saved App is installed, choose **Continue installation** on the saved connection. Weave confirms with GitHub that it is the same App and organization, records the new name and continues installation without creating another App. ## Rotate credentials Under **Connection maintenance**, you can rotate the App's credentials without reconnecting or reimporting: * **Private key:** generate a new key in the App settings on GitHub, paste it into **Replacement App private key** and choose **Verify and replace key**. Weave confirms the key authenticates as the same App before saving it, and running imports switch to it automatically. Delete the old key in GitHub afterward. * **Webhook secret:** choose **Rotate webhook secret**. Weave saves a new secret and sends it to GitHub. Deliveries signed with the previous secret are still accepted for one hour. If GitHub doesn't confirm the update, choose **Retry webhook secret update** to resend the same secret. Confirm whether your organization permits repository contents, patches, clones and derived analysis to be processed and stored by the configured Weave deployment. Existing clone exclusions and retention controls continue to apply. ## Resume and maintain a connection * **App saved, installation pending:** continue installation from the saved connection. You can reuse the App after a restart. * **Uncertain App creation:** inspect GitHub's organization Apps before restarting. A manifest conversion cannot safely be replayed if its response was lost before Weave saved the credentials. * **Suspended or uninstalled:** restore access in GitHub, then refresh or continue installation. * **Disconnect:** stops future access and removes stored credentials. Imported history remains. Remove the App in GitHub as well to revoke any token already issued there. * **Reconnect or replace App:** start a new manifest from the saved connection. The original connection identity and imported history remain; old queued App work cannot restore access. The connection screen reports verified installation, repository discovery and webhook receipt separately. “Connected” does not mean historical imports have finished. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.