You can run a private Git server on a VPS by securing the host first, installing a forge such as Gitea or GitLab Self-Managed, exposing only the required network services, and backing up data somewhere other than the VPS itself. For a personal project or small team, Gitea generally keeps resource use and administration lower. GitLab Self-Managed is the better fit when integrated CI/CD, registries, and broader project-management features justify more CPU, memory, storage, and maintenance.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The exact installation command depends on the Linux distribution and forge version, so use the current installation procedure for the release you select. The architecture and security steps below remain the same.
As an Amazon Associate I earn from qualifying purchases.
What a private Git server on a VPS provides
A self-hosted Git service stores repositories on infrastructure you control instead of a public code-hosting account. A typical deployment combines four layers:
- VPS and operating system: a supported Linux release with a stable public IP address or DNS name.
- Forge application: Gitea or GitLab Self-Managed supplies repository browsing, users, permissions, pull or merge requests, and related project features.
- Transport: HTTPS for the web interface and Git-over-SSH for authenticated repository operations.
- Data protection: independent backups, monitoring, patching, and a tested recovery procedure.
“Private” is an access policy, not a network configuration by itself. A repository can be marked private while an exposed, unpatched server, leaked deploy key, or overly broad token still compromises it. Treat the VPS, forge, accounts, keys, and backups as one security system.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Choose the forge before provisioning
| Decision area | Gitea | GitLab Self-Managed |
|---|---|---|
| Resource footprint | Usually the lighter option for personal projects and small teams. | Higher operational and resource overhead; size the VPS for the features and concurrent jobs you will run. |
| Core collaboration | Focused repository hosting, issues, reviews, and access controls. | Broader integrated planning and collaboration features. |
| CI/CD and registries | Can integrate with external runners and tools; confirm the components you need. | Integrated CI/CD and registry capabilities are a principal reason to accept the added complexity. |
| Administration | Fewer moving parts for a small installation. | More services, settings, upgrades, and backup considerations. |
| Backup scope | Back up the application database, repositories, attachments, configuration, and any external services you add. | The supported archive can include database data, configuration, repositories and LFS objects, artifacts and job logs, registries, wikis, uploads, and other project data. Redis, object storage, configuration files, and TLS or SSH keys may require separate handling. |
| Best fit | One person or a small team that wants a straightforward private forge. | A team that needs an integrated DevOps platform and can operate it continuously. |
Do not select a forge solely by counting features. Include the cost of upgrades, storage growth, runner capacity, database maintenance, and recovery testing. A smaller, fully patched service is safer than a larger platform that nobody has time to maintain.
Plan the VPS and DNS
Use a supported host
Choose a currently supported Linux image rather than an end-of-life distribution. Give the service a static public address or a stable DNS record such as git.example.com. Record the VPS region, operating-system version, forge version, database engine, data directory, and service account in your operations notes. Those details make a later migration or restore far less error-prone.
Free tools Windows power users keep installed
One-click scans. No signup required.
Estimate storage from more than the size of the repositories you have today. Git object databases, large-file storage, attachments, package registries, CI artifacts, job logs, database growth, backups, and operating-system updates all consume disk. Keep free space available for upgrades and emergency logs; a full filesystem can prevent both Git pushes and database recovery.
Create administrative access before installing software
- Log in through the provider’s console or initial administrator account.
- Create a separate, non-root user with narrowly scoped
sudoaccess. - Install your public SSH key for that user and verify a second login in a new terminal.
- Keep the provider console or recovery path available before changing SSH settings.
- After key login works, disable password-only administration and avoid routine work as root.
- Apply all operating-system security updates and reboot if the kernel or other critical services require it.
Never upload a private key to the forge. The forge receives a public key; the private half stays on the client or approved hardware-backed device and is protected with a passphrase.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Define the network surface
Enable the provider firewall before making the service public, then apply a host firewall as an additional control if your operating model supports it. Start with the smallest useful surface:
| Service | Port and protocol | When to allow it |
|---|---|---|
| Web interface and API | TCP 443 (HTTPS) | Required for normal browser and HTTPS Git access. |
| HTTP | TCP 80 | Only when redirecting to HTTPS or completing certificate issuance; do not leave it serving unencrypted sessions. |
| Git SSH | TCP on the selected SSH port | Required if clients clone and push over SSH. Use the forge’s documented SSH endpoint and avoid confusing it with administrative SSH. |
| Administrative SSH | TCP on your administration port | Restrict the source range to trusted addresses where feasible. Do not expose it broadly when a provider console, VPN, or bastion can narrow access. |
| Database, cache, internal services | Not publicly exposed | Bind these services to localhost or a private network and allow only the forge components that need them. |
GitLab’s hardening guidance notes that basic usage needs only TCP ports 80 and 443 publicly open; an SSH-based Git workflow additionally needs the SSH path you configure. Rules should specify both destination port and permitted source ranges. Review IPv4 and IPv6 separately so an unintended IPv6 listener does not bypass your IPv4 policy.
Install the forge safely
Use the current official installation method for the exact forge release and Linux distribution. Avoid copying a command from an old tutorial: package names, service units, database requirements, and reverse-proxy settings change between releases.
Installation records to keep
- Forge name and exact version.
- Linux distribution and version.
- Database type, version, database name, and service account.
- Repository, attachment, LFS, artifact, registry, and configuration directories.
- System user that owns the forge process and data.
- Public URL and the ports used by the web and SSH endpoints.
- Where logs are written and how log rotation is configured.
Run the application under its dedicated unprivileged service account. Do not give the forge process unrestricted shell access or ownership of unrelated system directories. If you use a reverse proxy, place the proxy and forge on a private interface and allow the forge’s web port only from the proxy.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Set the canonical URL and HTTPS
Choose one public hostname
Point the DNS record at the VPS and configure the forge’s canonical URL to the same hostname, including the correct scheme. Consistent canonical URLs prevent broken clone links, callback failures, incorrect webhook targets, and mixed-content warnings. Decide whether the service is reached at the root hostname or a path before creating repositories; changing that later can require updating every remote URL.
Terminate TLS at the forge or a reverse proxy
Gitea supports built-in HTTPS with a certificate and private key. Its documentation also describes a reverse-proxy arrangement in which the proxy is the public TLS endpoint while Gitea remains on a private network. Either design is valid:
Recommended Free Tools
- Built-in TLS: fewer components, suitable when the forge is the only public web service.
- Reverse proxy: useful when several services share the VPS, when you need centralized certificate renewal, or when the proxy handles redirects and security headers.
Use a publicly trusted certificate for ordinary client access. A self-signed certificate is appropriate only for controlled evaluation, because every Git client and browser must then be configured to trust your private certificate authority or certificate. Ensure HTTP redirects to HTTPS and that the application knows the original HTTPS scheme when it is behind a proxy.
Create secure Git-over-SSH access
Generate a client key
On each client, generate an Ed25519 key where supported, protect it with a passphrase, and upload only the public key through the forge account settings. GitLab documents ED25519 as preferred because it is more secure and performant than RSA keys. It also documents ED25519_SK and ECDSA_SK hardware-backed variants; ED25519_SK requires OpenSSH 8.2 or later on both the client and server.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use an SSH agent or operating-system key store so you do not repeatedly expose the passphrase. For automation, create a narrowly scoped deploy key or machine identity rather than reusing a person’s unrestricted key.
Verify the host identity before the first push
- Obtain the server’s SSH host-key fingerprint through a trusted administrative channel, such as the provider console or your documented deployment record.
- Connect from a client and compare the presented fingerprint with that record.
- Accept the key only after it matches. A changed fingerprint later should be investigated, not blindly accepted.
- Run the forge’s documented SSH test command and confirm that authentication succeeds without granting an interactive shell unless the forge explicitly provides one.
Use a per-host entry in the client’s SSH configuration when the forge’s Git SSH port differs from administrative SSH. This lets repository URLs remain stable while keeping the two access paths distinct.
Configure private repositories and least privilege
Set defaults before inviting users
- Set repository visibility to private by default.
- Create groups or organizations that match real teams rather than granting access repository by repository when many projects share the same membership.
- Assign the lowest role that permits the required work. Separate read, issue, review, push, and administrative duties.
- Require strong account passwords and multi-factor authentication where the forge supports it, especially for administrators.
- Review who can create public repositories, register runners, create tokens, add deploy keys, and configure webhooks.
Test permissions as a user, not only as an administrator
Create a temporary read-only account and verify that it can clone but cannot push, alter settings, create releases, or read another private repository. Test a normal contributor and a repository administrator separately. Delete test accounts and keys after validation.
Handle personal access tokens, deploy keys, webhooks, and CI runners as independent credentials. Give each a purpose, minimum scope, owner, expiration or rotation plan, and documented revocation procedure. A webhook that can reach an internal service or a runner with broad host access can become a path around repository permissions.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Back up the complete service
A VPS snapshot alone is not a complete Git backup. It can capture a damaged filesystem, an active database transaction, or an attacker-controlled state. Schedule the forge’s supported backup command, copy its output to storage that is not the VPS disk, encrypt it, and retain multiple generations.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Include every data class you actually use
| Data | Why it matters | Backup treatment |
|---|---|---|
| Git repositories | Commit history, branches, tags, and references. | Included in the forge backup or copied with a documented, consistent method. |
| Large-file storage | LFS pointers alone are useless without the corresponding objects. | Verify that LFS objects are included and restorable. |
| Database | Users, permissions, issues, reviews, settings, and metadata. | Use the forge-supported, consistency-aware backup procedure. |
| Attachments, uploads, wikis, artifacts, and job logs | Project data that may not be inside the Git object database. | Include each enabled feature; GitLab’s archive documentation lists these categories among the data it can protect. |
| Container or package registries | Published build outputs may not be reproducible from source. | Back up registry storage and its metadata when enabled. |
| Configuration and secrets | Without them, data may be difficult to interpret or restore. | Back up application configuration, encryption secrets, and environment-specific settings separately and securely. |
| TLS and SSH host keys | Changing them unexpectedly causes trust warnings and can break clients. | Store encrypted copies with restricted access. |
| Redis and object storage | Some installations use them outside the main archive. | Follow the forge’s separate backup procedure; do not assume the primary archive contains them. |
Encrypt backup files in transit and at rest, restrict who can decrypt them, and keep at least one off-site or offline copy. A backup that has never been restored is an unverified assumption.
Perform a restore rehearsal
- Provision a separate, isolated test instance with a supported Linux image.
- Install the same forge release, database type, and required extensions recorded for production.
- Restore the database, repositories, LFS objects, uploads, artifacts, registry data, configuration, and keys according to the documented order.
- Point a temporary DNS name or local hosts entry at the test instance so production users are not redirected accidentally.
- Log in as an administrator and a normal user; inspect permissions, private visibility, issues, reviews, wikis, and attachments.
- Clone a repository, verify commit history and branches, fetch LFS files, and perform a test push to a disposable repository.
- Confirm webhook, runner, registry, and certificate behavior if those features are part of your service.
- Record elapsed time, missing files, manual fixes, and the exact commands needed for the next recovery.
Repeat the rehearsal after major forge upgrades or changes to storage, database, runners, or encryption keys.
Operate and maintain the server
Patch on a defined schedule
Track operating-system and forge security advisories. Test upgrades on a disposable instance when practical, take a verified backup immediately before the change, and keep the provider recovery path available. Document rollback limits: restoring a database backup may not undo a schema migration, so follow the forge’s supported upgrade order.
Monitor the failure signals
- Disk use, inode use, and growth of repositories, LFS, artifacts, logs, and registries.
- Memory pressure, CPU saturation, load averages, and database latency.
- Failed backups, certificate-renewal errors, and service restarts.
- Authentication failures, unexpected administrator changes, new deploy keys, token creation, and webhook edits.
- HTTP 5xx responses, failed Git pushes, runner queues, and object-storage errors where applicable.
Alert on thresholds that leave time to act rather than waiting for a full disk or expired certificate. Keep logs long enough to investigate incidents, but rotate them so logging cannot consume the repository volume.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Troubleshoot common setup failures
DNS resolves, but the site is unreachable
- Check the provider firewall and host firewall for TCP 443.
- Verify the reverse proxy or forge is listening on the intended interface and port.
- Check IPv6 records and firewall rules separately.
- Confirm the certificate covers the exact hostname being used.
HTTPS works in a browser, but Git clone fails
- Copy the clone URL directly from the repository page and compare its hostname and path with the canonical URL.
- Check that the client trusts the certificate chain and that the system clock is correct.
- Inspect proxy headers and redirects; Git clients may fail when a proxy advertises an internal hostname.
SSH authentication is denied
- Confirm the public key was added to the intended user account and that the private key is loaded in the client agent.
- Check the SSH port and per-host client configuration.
- Verify server-side file ownership and permissions for the forge’s SSH key store.
- Use verbose client diagnostics and the forge’s documented test command, but do not enable password fallback merely to hide a key problem.
Pushes fail with “no space left”
Check the repository volume, temporary directory, database volume, and inode count. Remove only data identified by the forge as safe to prune, such as expired artifacts or rotated logs. Expand storage before attempting a large migration, then update monitoring thresholds.
A restore starts but projects are incomplete
Look for omitted LFS objects, uploads, artifacts, registry blobs, object storage, Redis data, encryption secrets, or configuration files. Compare the restore checklist with the features enabled in production; repository commits alone do not represent the complete project.
Quick Recap
Final deployment checklist
- Supported Linux image, stable DNS, and documented version inventory.
- Non-root administrator, verified key login, password administration disabled, and recovery console available.
- Provider firewall enabled; only HTTPS, required Git SSH, and restricted administration exposed.
- Private database and internal services bound to private interfaces.
- Canonical URL configured and HTTPS enforced with a trusted certificate.
- Ed25519 or an approved hardware-backed key used where supported; private keys remain private and passphrase-protected.
- Private visibility defaults, least-privilege roles, and tested read-only access.
- Tokens, deploy keys, webhooks, and runners inventoried and scoped.
- Encrypted, off-host backups covering repositories, database, LFS, attachments, artifacts, registries, configuration, object storage, and keys as applicable.
- Restore rehearsal completed and documented.
- Patch, certificate-renewal, monitoring, disk-growth, and access-review schedules assigned to a person or team.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
