Set up and harden your own Git server with Gitea

Gitea is a light Git service you run on your own server: repositories, issue tracking, pull requests and (optionally) CI. It runs comfortably on a few hundred MB of memory, so a small cloud server is enough. Your code stays with you and you pay nothing per user.

Requirements

• Docker and Compose (see Installing Docker).
• A domain (for example git.yourdomain.com) and HTTPS with Caddy.

1. The Compose file

mkdir -p ~/gitea && cd ~/gitea

compose.yaml:

services:
  gitea:
    image: gitea/gitea:latest
    container_name: gitea
    restart: unless-stopped
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - GITEA__server__DOMAIN=git.yourdomain.com
      - GITEA__server__ROOT_URL=https://git.yourdomain.com/
      - GITEA__service__DISABLE_REGISTRATION=true
      - GITEA__service__REQUIRE_SIGNIN_VIEW=true
    volumes:
      - ./data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "127.0.0.1:3000:3000"
      - "2222:22"

The web interface binds to local port 3000 only; the reverse proxy serves it to the outside. Port 2222 is opened for Git’s SSH access (the server’s own SSH stays on 22). DISABLE_REGISTRATION closes new user sign-up and REQUIRE_SIGNIN_VIEW stops repositories being viewed without signing in.

2. Start it and finish the setup

docker compose up -d
sudo ufw allow 2222/tcp

Open https://git.yourdomain.com (point Caddy first) and, in the setup wizard, keep SQLite as the database (enough for small teams) and create the admin account. After setup the admin settings and app.ini live under ./data/gitea/conf.

3. Your first repository and SSH key

1. Add your public SSH key under Settings › SSH/GPG Keys.
2. Create a new repository and clone it: git clone ssh://git@git.yourdomain.com:2222/user/repo.git

4. Hardening checklist

• Registration off: add new users from the admin side.
• Two-factor authentication: turn it on for everyone, admin included (Settings › Security).
• Strong passwords and, where possible, SSH keys only.
• Stay current: docker compose pull && docker compose up -d; read the release notes.
• Firewall: open only 22 (server SSH), 80/443 (Caddy) and 2222 (Git SSH) (see the security checklist).
• Secrets: don’t commit passwords or keys; use CI secret variables.

Backups

The ./data folder holds repositories, the database and settings. For a consistent backup you can use Gitea’s own command:

docker exec -u git gitea gitea dump -c /data/gitea/conf/app.ini -f /data/gitea-dump.zip

Copy the resulting file off the server, and take a snapshot before risky updates.

Start with Melinhost

Gitea runs comfortably on a small cloud server; upgrade the plan as your team grows.