You can run a private Git service on a Linux VPS with Gogs by installing a pinned Gogs release (or its official container image), giving it a database and persistent storage, then placing it behind a reverse proxy for HTTPS. A practical small deployment uses the project’s starter guidance of 2 CPU cores and 512 MB RAM for teamwork, a dedicated git account, SQLite3 or a separately managed relational database, and scheduled off-server backups.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This guide covers binary and Docker installations, database choices, app.ini settings, SSH and HTTPS clone URLs, Nginx proxying, security controls, upgrades, and recovery.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What you need before installing Gogs
- A Linux VPS with a public IPv4 address (and IPv6 if you intend to publish it), administrative SSH access, and a DNS name such as
git.example.com. - A distribution supported by the Gogs release you choose. The official releases provide Linux archives for amd64, arm64, and 386, so select the archive matching the VPS architecture.
- At least the project’s published starter baseline for teamwork: 2 CPU cores and 512 MB RAM. The project also describes a $5 Digital Ocean Droplet or a Raspberry Pi as enough to get started. These are guidance figures, not a capacity guarantee or a benchmark; repository count, CI jobs, traffic, and database workload can require more resources.
- A plan for persistent storage. Repositories, uploaded files, attachments, logs, the configuration, and the database must survive a process restart and a container replacement.
- A hostname whose DNS record points to the VPS. Use the final hostname when setting
DOMAINandROOT_URL; changing it later affects clone URLs and links in notifications.
Keep the VPS patched, restrict administrative SSH to your own keys, and expose only the ports you actually use. Gogs supports repository access over SSH, HTTP, and HTTPS, but the public web service normally needs only HTTP on the local machine and HTTPS at the reverse proxy.
Choose a deployment model
| Concern | Linux binary | Docker |
|---|---|---|
| Upgrade control | You replace the archive and control the system service directly. | You pin an image tag and replace the container while keeping data volumes. |
| Filesystem ownership | Files can be owned directly by the dedicated git account. |
Container user IDs and bind-mounted directory ownership must agree. |
| Ports | The service listens on its configured local HTTP and SSH ports. | Publish the container’s HTTP and SSH ports explicitly, for example 3000 and 10022. |
| Backups | Back up the Gogs data directory and the archive produced by gogs backup. |
Back up the named or bind-mounted volumes and run the backup command inside the container. |
| Rollback | Keep the previous archive and restore it after stopping the service. | Retag or redeploy the previous image while retaining the same volumes. |
For a single VPS where you want the fewest moving parts, the binary installation with SQLite3 is straightforward. Docker is useful when your VPS already has a container-management workflow or when you want Gogs and PostgreSQL separated into services. Neither model removes the need for tested backups.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Install the Gogs binary on Linux
1. Create the service account and directories
Do not run Gogs as root. Create a system account and directories that it owns:
sudo useradd --system --create-home --shell /bin/bash git
sudo mkdir -p /var/lib/gogs/{custom,data,log,repositories}
sudo mkdir -p /etc/gogs
sudo chown -R git:git /var/lib/gogs
sudo chmod 750 /var/lib/gogs /var/lib/gogs/custom /var/lib/gogs/data /var/lib/gogs/log /var/lib/gogs/repositoriesDownload the Linux archive that matches your VPS from the official Gogs releases page, verify its checksum when one is published, and unpack it. Place the resulting executable at /usr/local/bin/gogs and make it executable:
sudo install -m 0755 gogs /usr/local/bin/gogs
/usr/local/bin/gogs --versionThe version check confirms that the executable runs on the selected architecture before you create repositories or a database.
2. Select and prepare a database
Gogs lists PostgreSQL, MySQL, MariaDB, SQLite3, and compatible backends. SQLite3 stores one database file alongside Gogs and is the simplest starting point for a single-host service. A separately administered PostgreSQL, MySQL, or MariaDB instance adds connection and upgrade work but keeps database administration independent from the application host and is often preferable when several services, operators, or migration requirements are involved. The project does not publish a universal repository-count or concurrency threshold at which you must switch.
For SQLite3, create the [database] section shown below and ensure the git account can write to the data directory. For a server database, create a dedicated database and login, grant that login access only to that database, and record the hostname, port, database name, username, and password for the installer. Do not reuse a VPS administrator account.
3. Create the initial configuration
Save the following as /var/lib/gogs/custom/conf/app.ini. Replace the example hostname and secret; the SQLite settings are shown as the small-installation option.
Free tools Windows power users keep installed
One-click scans. No signup required.
[database]
DB_TYPE = sqlite3
PATH = data/gogs.db
[server]
DOMAIN = git.example.com
ROOT_URL = https://git.example.com/
PROTOCOL = http
HTTP_ADDR = 127.0.0.1
HTTP_PORT = 3000
SSH_DOMAIN = git.example.com
SSH_PORT = 22
START_SSH_SERVER = false
[security]
INSTALL_LOCK = true
SECRET_KEY = replace-with-a-long-random-value
[service]
DISABLE_REGISTRATION = true
[auth]
TRUSTED_PROXY_IPS = 127.0.0.1/32,::1/128Generate a secret instead of typing a memorable phrase:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
openssl rand -hex 32ROOT_URL is the public URL that Gogs puts into browser links and clone commands. In this example TLS terminates at Nginx, so Gogs speaks plain HTTP only on loopback and PROTOCOL is http. If Gogs itself terminates TLS, configure the corresponding HTTPS protocol and certificates instead. HTTP_ADDR = 127.0.0.1 prevents direct access from the network; the proxy is the public entry point.
Use the server database values instead of SQLite when appropriate:
[database]
DB_TYPE = postgres
HOST = 127.0.0.1:5432
NAME = gogs
USER = gogs
PASSWD = use-a-dedicated-database-password
SSL_MODE = disableUse the exact option names and supported values from the release you install. Keep database credentials readable only by the service account and administrators.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →4. Run Gogs with systemd
Create /etc/systemd/system/gogs.service:
[Unit]
Description=Gogs Git service
After=network.target
[Service]
Type=simple
User=git
Group=git
WorkingDirectory=/var/lib/gogs
ExecStart=/usr/local/bin/gogs web --config /var/lib/gogs/custom/conf/app.ini
Restart=on-failure
RestartSec=5
PrivateTmp=true
[Install]
WantedBy=multi-user.targetEnable it and inspect the first startup:
sudo systemctl daemon-reload
sudo systemctl enable --now gogs
sudo systemctl status gogs
sudo journalctl -u gogs -n 100 --no-pagerOpen http://127.0.0.1:3000 from the VPS itself with a text-based client or proceed directly to the proxy configuration. If the service exits, inspect the journal for a malformed app.ini, a missing directory, or a database permission error.
Put Gogs behind Nginx and enable HTTPS
1. Proxy the public hostname
Install Nginx from your distribution, create a server block for the DNS name, and proxy requests to the loopback listener:
server {
listen 80;
server_name git.example.com;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 600s;
}
}Enable the site, test the configuration, and reload Nginx:
sudo nginx -t
sudo systemctl reload nginxUse an ACME-compatible certificate client to request a certificate for the hostname, then configure Nginx to listen on 443 with that certificate and redirect port 80 to HTTPS. Renewals must reload Nginx after a successful renewal. The exact certificate-client command depends on your Linux distribution and the client you select.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
2. Configure proxy trust correctly
Gogs uses forwarded headers to understand the original scheme and client address. Trust only the proxy addresses you operate. The [auth] TRUSTED_PROXY_IPS setting should contain loopback when Nginx is local, plus any other fixed proxy address that is genuinely under your control. Do not trust every remote address.
Gogs v0.14.3 fixed a flaw where a reverse-proxy authentication header could be accepted from any remote address. In that release the header is restricted to addresses listed in [auth] TRUSTED_PROXY_IPS. Set this allow-list before enabling any proxy-provided authentication header, and review it after a topology change.
Enable SSH clone URLs
SSH access is independent of the web proxy. With START_SSH_SERVER = false, Gogs advertises the host’s normal SSH service and writes keys to the account’s authorized-keys file. Ensure the public SSH port reaches the VPS and that the git account can use the key-management path required by your release. If another service already occupies port 22, publish Gogs SSH on a separate port and set SSH_PORT to that public port so generated URLs are correct.
After creating a repository and adding an SSH key in the user settings, test both forms:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
git clone [email protected]:owner/project.git
ssh -T [email protected]For a nonstandard public port, use the SSH URL generated by Gogs or an SSH config entry that maps the hostname to that port. A common failure is a URL that still shows the internal port or an old hostname; correct DOMAIN, SSH_DOMAIN, SSH_PORT, and ROOT_URL, then restart Gogs.
Use HTTP and HTTPS clone URLs safely
Gogs supports HTTP and HTTPS repository access. Once Nginx serves the hostname over TLS and ROOT_URL uses https://, the web interface will generate HTTPS clone links. Keep port 3000 bound to loopback so users cannot bypass TLS with a direct VPS address.
HTTPS cloning authenticates with the credentials and token mechanism supported by your Gogs release. Do not place passwords in shell history or permanently embed them in remote URLs. For automation, create a narrowly scoped token or deploy key, store it in the automation system’s secret store, and revoke it when the job or person no longer needs access.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Docker deployment with PostgreSQL
The official Docker documentation provides versioned image tags and an example that maps HTTP and SSH ports while using PostgreSQL. Pin a specific tag rather than using latest, and keep the image tag, database data, and Gogs data under an upgrade plan.
A minimal Compose layout can look like this:
services:
db:
image: postgres:16
environment:
POSTGRES_DB: gogs
POSTGRES_USER: gogs
POSTGRES_PASSWORD: change-this-secret
volumes:
- postgres-data:/var/lib/postgresql/data
gogs:
image: gogs/gogs:0.14.3
depends_on:
- db
ports:
- 127.0.0.1:3000:3000
- 22:22
volumes:
- gogs-data:/data
volumes:
postgres-data:
gogs-data:Treat the image tag above as an example of pinning: confirm that the tag is published for your architecture and matches the release you intend to run. During first-run setup, select PostgreSQL and enter the Compose service name db, the database name, user, and password. If SSH is published on a host port other than 22, set Gogs’ public SSH_PORT accordingly. Do not expose PostgreSQL to the public internet unless a deliberate remote-database design requires it.
Bind mounts and named volumes must be included in your backup plan. Before upgrading, stop or quiesce writes, back up both Gogs and PostgreSQL, pull the new pinned image, and retain the old image until the new container has passed login, clone, push, and webhook checks.
Security hardening checklist
- Run the service as
git, not asroot, and make the configuration, repositories, logs, and database writable only where necessary. - Set production mode with
RUN_MODE = prodif your release’s configuration uses that setting, and lock the web installer after setup withINSTALL_LOCK = true. - Generate a strong, unique
SECRET_KEYand protect it like a database credential. Changing it can invalidate encrypted data or sessions, so rotate it only with a migration plan. - Disable open registration unless you intentionally run a public forge. Create administrators and ordinary users with the least privilege they need.
- Allow inbound traffic only for SSH administration, the public HTTPS service, and the SSH clone port. Keep the Gogs HTTP listener private when a reverse proxy is in front.
- Set
TRUSTED_PROXY_IPSto exact proxy addresses or networks. A broad trust range can let an untrusted client forge forwarded or authentication headers. - Patch Gogs and the operating system. The official releases page lists v0.14.3, released 2026-06-07, with fixes for reverse-proxy authentication trust, SSRF through HTTP redirects, unauthenticated file upload, protected-branch bypass, and other defects. Check the current official release page immediately before installing or writing an upgrade procedure; do not assume an older version remains safe.
- Use firewall rules and rate limits at the VPS or proxy layer, monitor disk usage, and alert on repeated login failures and service restarts.
Back up and restore Gogs
Create an application backup
The Gogs CLI command backup writes a single archive containing the database, repositories, and related files:
sudo -u git /usr/local/bin/gogs backup --config /var/lib/gogs/custom/conf/app.iniUse a destination and retention policy appropriate to your CLI version, then copy the resulting archive off the VPS. A local archive does not protect against disk loss, account compromise, or a deleted VPS. Encrypt archives before placing them in object storage, restrict access, and periodically verify that an archive can be opened.
For Docker, run the same Gogs command inside the application container and write the archive to a mounted backup directory. Also protect the PostgreSQL volume or use a database-native dump when your recovery plan requires point-in-time database recovery.
Restore during migration or recovery
Install the same or a compatible Gogs release, stop writes, and restore into an empty or deliberately prepared target:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
sudo systemctl stop gogs
sudo -u git /usr/local/bin/gogs restore --from /secure/backups/gogs-archive.zip --config /var/lib/gogs/custom/conf/app.ini
sudo systemctl start gogsAfter restoring, check the administrator login, repository browsing, an SSH clone, an HTTPS clone, a test push, attachments, webhooks, and background tasks. Confirm that ownership is again assigned to git and that the public hostname in ROOT_URL is correct.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Protect non-Gogs SSH keys
The CLI reference warns that rewrite-authorized-keys replaces the entire authorized_keys file. Before running it, copy any keys used for VPS administration or other services. Otherwise a key that is not managed by Gogs can be deleted and lock you out.
Upgrade and rollback procedure
- Read the current release notes and confirm architecture, database compatibility, and configuration changes. The release page’s current entry at the time of writing is v0.14.3, but verify it immediately before an upgrade.
- Announce a maintenance window and stop pushes. Create and download a Gogs backup; back up the external database or Docker volumes as applicable.
- Record the running version, service file,
app.ini, proxy configuration, and ownership and permission state. - Install the new binary or pull the pinned container image without deleting the existing data.
- Start Gogs, watch logs, and test login, browsing, SSH clone, HTTPS clone, push, and any integrations.
- If a migration fails, stop the service, restore the prior binary or image, and use the backup according to your tested recovery procedure. Do not repeatedly run schema migrations against an unverified backup.
Troubleshooting common failures
The browser returns 502 Bad Gateway
Confirm that Gogs is running and listening on the address and port in HTTP_ADDR and HTTP_PORT. From the VPS, request the local endpoint, inspect journalctl -u gogs, then run nginx -t. A proxy aimed at 127.0.0.1:3000 will fail if Gogs is bound to another address or if the systemd service failed to read app.ini.
Clone URLs contain the wrong host, scheme, or port
Correct DOMAIN, ROOT_URL, SSH_DOMAIN, PROTOCOL, HTTP_PORT, and SSH_PORT. Make sure Nginx sends X-Forwarded-Proto and that the proxy address is trusted. Restart Gogs after editing the configuration and generate a fresh clone URL.
Pushes fail with permission errors
Check ownership of the repository, data, and log directories, and verify that the process is running as git. In a container, compare the container’s user ID with the owner of bind-mounted directories. Also verify that the user has write permission to the repository and that disk space and inodes are available.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11SSH works for the administrator but not for Git users
Verify the public SSH port, the generated authorized-keys entries, and the git account’s shell and home directory. If you changed ports, update SSH_PORT so the displayed URL matches the port users actually reach. Preserve administrative keys before any authorized-key rewrite.
Database connection errors appear after a reboot
Check that the database service starts before Gogs, the configured hostname resolves on the VPS, credentials remain valid, and the database account can access the selected database. For Docker, inspect both containers and their shared network rather than using localhost for the database from inside the Gogs container; use the database service name.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
