How to Self-Host a Git Server with Gogs on a Linux VPS

You can run a private Git service on a modest Linux VPS with Gogs: install the release that matches your CPU, run it as a dedicated account, connect it to SQLite or a supported relational database, and put its web interface behind HTTPS. A practical production layout is Gogs listening on localhost, Nginx terminating TLS, and OpenSSH (or Gogs’ SSH server) handling repository access.

Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.

The Gogs project describes a single-board computer or a $5 Digital Ocean Droplet as enough to get started, and gives 2 CPU cores with 512MB RAM as a baseline for teamwork. Those are starter guidelines, not a capacity guarantee or a benchmark; repository size, users, actions and backup retention determine when you need more resources.

#	Preview	Product	Price
1		TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for...	$13.98	Buy on Amazon
2		Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen...	$17.99	Buy on Amazon
3		New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord	$8.99	Buy on Amazon
4		BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees	$199.99	Buy on Amazon
5		Pokemon FireRed and LeafGreen Strategy Guidebook: Affordable & Unofficial Strategy Guide...	$19.98	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

What the finished setup looks like

A browser reaches https://git.example.com. Nginx accepts ports 80 and 443, redirects HTTP to HTTPS, and proxies requests to Gogs on a private loopback address such as 127.0.0.1:3000. Git clients use HTTPS clone URLs through the same proxy or SSH clone URLs through the VPS’s SSH port. Gogs stores repository data and application files on the VPS, while its database can be SQLite3 on the same host or PostgreSQL, MySQL or MariaDB administered separately.

• Public name: a DNS record such as git.example.com pointing to the VPS.
• Web path: Nginx on 443 to Gogs’ internal HTTP listener.
• Git over SSH: the system SSH daemon managing Gogs keys, or Gogs’ built-in SSH server on a chosen port.
• Persistence: the Gogs installation, custom configuration, repositories, attachments and database must all be included in backups.

Check the VPS before installing

Choose the release architecture

The official release page publishes Linux archives for amd64, arm64 and 386. Check the VPS architecture with uname -m: common outputs are x86_64 for amd64 and aarch64 for arm64. Download the archive for that architecture and verify its checksum when the release page supplies one. Do not install an amd64 binary on an arm64 machine.

#1 Best Overall

Sale

TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black

• [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
• [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
• [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
• [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
• [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.

$13.98

Buy on Amazon

Use a supported, maintained operating system

Ubuntu or Debian are convenient examples because the commands below use their package names. Apply the equivalent package and service commands on another distribution. Fully update the host, enable automatic security updates if your distribution supports them, and keep a recovery console or provider snapshot available before changing SSH settings.

Set DNS and firewall rules first

Create an A record for your hostname (and an AAAA record only when IPv6 is correctly configured). Allow inbound TCP 22 for administrative SSH, TCP 80 for certificate issuance and redirects, and TCP 443 for the web service. Do not expose Gogs’ internal port 3000 publicly when Nginx is on the same host. If you select a separate SSH port for Git, allow that port instead of, or in addition to, 22.

Create a dedicated service account

Never run the web application as root. Create a non-login account named git, give it ownership of the Gogs data directories, and keep administrator files outside the repository storage tree. A Debian or Ubuntu example is:

sudo adduser --system --shell /bin/bash --group --disabled-password git
sudo mkdir -p /home/git
sudo chown git:git /home/git

Install only the packages you need for your selected database, Nginx, TLS and archive management. A dedicated account limits the damage from an application or plugin compromise.

Binary installation or Docker?

Both approaches are supported. Select one deliberately because the filesystem layout, upgrade command and backup volumes differ.

A binary install is straightforward on one VPS and integrates naturally with the host’s SSH daemon. Docker is attractive when you already operate Compose, image pinning and volume backups. Do not treat a container restart as a backup: repositories and the database must live on persistent storage.

Install Gogs from the Linux archive

1. Download the matching archive. From the official releases page, download the current Linux archive for your architecture into a temporary directory. The release listing covered by this guide shows v0.14.3, dated 2026-06-07; check that page again immediately before installing because a newer security release may exist.
2. Extract it under the service account.

   sudo -u git mkdir -p /home/git
   sudo -u git tar -xzf /tmp/gogs_*_linux_amd64.tar.gz -C /home/git

   The extracted directory is normally named gogs. If the archive uses a different directory name, rename it consistently and use that path in the service file.

   Rank #2

   Sale

   

   Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)

   • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
   • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
   • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
   • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
   • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.

   $17.99

   Buy on Amazon
3. Create writable directories.

   sudo mkdir -p /var/lib/gogs/{custom,data,log,repositories}
   sudo chown -R git:git /var/lib/gogs /home/git/gogs

   You may keep all data under /home/git/gogs instead; the important requirement is that the paths in app.ini exist and are writable by git.

4. Install a systemd unit. Create /etc/systemd/system/gogs.service with:

[Unit]
Description=Gogs self-hosted Git service
After=network.target

[Service]
Type=simple
User=git
Group=git
WorkingDirectory=/home/git/gogs
ExecStart=/home/git/gogs/gogs web --config /var/lib/gogs/custom/conf/app.ini
Restart=on-failure
RestartSec=5
Environment=USER=git HOME=/home/git

[Install]
WantedBy=multi-user.target

5. Enable but do not start until configuration exists.

   sudo systemctl daemon-reload
   sudo systemctl enable gogs

Select and configure the database

Gogs lists PostgreSQL, MySQL, MariaDB, SQLite3 and compatible backends. Support does not establish a universal repository-count or user-count threshold, so choose according to operational needs rather than a supposed hard limit.

SQLite3 for the first VPS

For a one-host installation, select SQLite3 in the web installer and point it to a file under the persistent data directory, such as /var/lib/gogs/data/gogs.db. Ensure the parent directory is owned by git. Stop Gogs before copying the file for a filesystem-level backup so the copy is consistent.

PostgreSQL example

On a PostgreSQL server, create a dedicated login and database rather than reusing an administrator account:

sudo -u postgres createuser --pwprompt gogs
sudo -u postgres createdb -O gogs gogs

In the installer, choose PostgreSQL, enter the database host and port, database name gogs, user gogs and the password you set. Restrict PostgreSQL’s pg_hba.conf and firewall rules to the VPS address or private network. For MySQL or MariaDB, create an equivalent dedicated database and account and apply the server’s documented encoding settings.

Set the essential Gogs configuration

The first-run installer writes custom/conf/app.ini. You can edit it afterward as the git user. The exact file location is the one supplied to --config in your systemd unit.

[server]
DOMAIN = git.example.com
ROOT_URL = https://git.example.com/
PROTOCOL = http
HTTP_ADDR = 127.0.0.1
HTTP_PORT = 3000
SSH_DOMAIN = git.example.com
SSH_PORT = 22
START_SSH_SERVER = false

[database]
DB_TYPE = sqlite3
PATH = /var/lib/gogs/data/gogs.db

[security]
INSTALL_LOCK = true
SECRET_KEY = paste-the-output-of-openssl-rand-hex-32-here

[server]
RUN_MODE = prod

Use one [server] section in the real file; the repeated heading above is separated only to show the related setting. A clean combined example is:

Rank #3

New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord

• [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
• [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
• [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
• [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
• [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by

$8.99

Buy on Amazon

[server]
DOMAIN = git.example.com
ROOT_URL = https://git.example.com/
PROTOCOL = http
HTTP_ADDR = 127.0.0.1
HTTP_PORT = 3000
SSH_DOMAIN = git.example.com
SSH_PORT = 22
START_SSH_SERVER = false

[database]
DB_TYPE = sqlite3
PATH = /var/lib/gogs/data/gogs.db

[security]
INSTALL_LOCK = true
SECRET_KEY = 6f2c9a5f0d8e4b1c7a3d9e2f6b8c1a4d

Generate your own secret instead of copying the example:

openssl rand -hex 32

DOMAIN and ROOT_URL control links shown in the web UI and the HTTPS clone URL. PROTOCOL = http is correct when Nginx terminates TLS and forwards plain HTTP over localhost; set the public URL to HTTPS so redirects and clone links remain secure. If Gogs itself terminates TLS, use its HTTPS settings instead and do not duplicate TLS termination accidentally.

HTTP_ADDR prevents direct Internet access to the backend. Set HTTP_PORT to the port Nginx proxies to. Keep RUN_MODE = prod, lock installation after the administrator is created, and never publish the generated SECRET_KEY.

Start Gogs and complete the installer

1. Confirm ownership and configuration permissions: sudo chown -R git:git /var/lib/gogs.
2. Start the service and inspect its status: sudo systemctl start gogs followed by sudo systemctl status gogs.
3. Read recent logs if it fails: sudo journalctl -u gogs -n 100 --no-pager.
4. Before adding Nginx, test locally with curl -I http://127.0.0.1:3000. A response confirms that the process is listening.
5. Open the installation page through the hostname once the proxy is configured. Select the database, set the site title and create the first administrator. Enable the installation lock afterward.

Put Gogs behind Nginx and enable HTTPS

Install Nginx, then create a server block for the public hostname. This example assumes Gogs listens on localhost port 3000:

server {
    listen 80;
    server_name git.example.com;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection upgrade;
        client_max_body_size 512m;
    }
}

Enable the site, validate the configuration with sudo nginx -t, and reload Nginx. The client_max_body_size value is an example for large repository pushes; choose a limit that matches your policy rather than copying it blindly.

Obtain a certificate for the hostname with your distribution’s ACME client, then configure Nginx to listen on 443 with the certificate and key, redirect port 80 to HTTPS, and retain the proxy headers above. A common Certbot flow is:

sudo certbot --nginx -d git.example.com

After TLS works, verify that the browser URL, repository web links and the HTTPS clone URL all use https://git.example.com/. If links still contain http://127.0.0.1:3000, correct ROOT_URL and restart Gogs.

Rank #4

BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees

• Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
• Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
• All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
• Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
• Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.

$199.99

Buy on Amazon

Enable SSH clone and push access

Use the host OpenSSH service

The simplest binary layout leaves START_SSH_SERVER = false and lets Gogs add users’ public keys to the git account’s authorized_keys file. Keep SSH_DOMAIN set to the public hostname and set SSH_PORT to the port users actually reach. Test with:

ssh -T [email protected]

Then copy the SSH clone URL shown on a repository page. If the VPS SSH daemon uses a nonstandard port, include it in Gogs’ SSH port setting and in the displayed URL. Do not disable your administrative account while changing the daemon; keep an existing session open until a second login succeeds.

Use Gogs’ built-in SSH server

The Docker example and some isolated deployments use Gogs’ own SSH listener. Set START_SSH_SERVER = true, choose an internal listen port, and expose a distinct host port when port 22 is already occupied. In Docker, map a host port such as 10022 to the container’s SSH port and set Gogs’ public SSH_PORT to 10022 so generated clone URLs are correct. Firewall the chosen port and test it explicitly with ssh -p 10022 [email protected].

Docker deployment with persistent volumes

Use a versioned image tag rather than latest. The following Compose pattern maps HTTP on 3000 and SSH on 10022 and uses PostgreSQL; adapt the volume paths to your backup plan:

services:
  db:
    image: postgres:16
    restart: unless-stopped
    environment:
      POSTGRES_DB: gogs
      POSTGRES_USER: gogs
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    volumes:
      - ./postgres:/var/lib/postgresql/data
  gogs:
    image: gogs/gogs:0.14.3
    restart: unless-stopped
    depends_on:
      - db
    ports:
      - 3000:3000
      - 10022:22
    volumes:
      - ./gogs:/data

Store POSTGRES_PASSWORD in a protected .env file, restrict host port 3000 to localhost or the internal network when Nginx is on the host, and back up both ./gogs and ./postgres consistently. During the web setup, use database host db, port 5432, database gogs, and the Compose credentials. Set the public SSH port to 10022 so clone links do not incorrectly advertise 22.

Back up and restore Gogs

The Gogs CLI’s backup command writes an archive containing the database, repositories and related files into a single ZIP archive. Run it as the service account with the same configuration used by the running instance:

sudo -u git /home/git/gogs/gogs backup --config /var/lib/gogs/custom/conf/app.ini

Record the archive path printed by the command, move or copy it to storage outside the VPS, and retain several dated generations. Encrypt off-site copies and test extraction. A database-only dump is not enough because repositories, attachments, avatars, configuration and SSH metadata also matter.

Best Value

Pokemon FireRed and LeafGreen Strategy Guidebook: Affordable & Unofficial Strategy Guide Walkthroughs

$19.98

Buy on Amazon

Restore on a replacement VPS

1. Install the same Gogs version, create the git account and stop the service.
2. Copy the archive to a protected directory and define its path, for example ARCHIVE=/var/backups/gogs/gogs-backup.zip.
3. Run sudo -u git /home/git/gogs/gogs restore --from $ARCHIVE --config /var/lib/gogs/custom/conf/app.ini.
4. Check ownership, database connectivity, repository permissions and the generated SSH keys before starting the service.
5. Start Gogs, review logs, sign in, and push a test commit over both HTTPS and SSH.

Practice the restore on a disposable VPS before you need it. Restoring into a newer release may require an intermediate upgrade; follow the release notes and keep the original archive untouched.

The CLI reference warns that rewrite-authorized-keys replaces the entire authorized_keys file. Preserve any non-Gogs administrative keys before running it, or you can lock out other SSH access.

Security settings that should not be skipped

• Run Gogs as the dedicated git account and keep the backend bound to localhost or a private interface.
• Use production mode, a long random SECRET_KEY, a unique database password and an installation lock.
• Use HTTPS for the web UI and verify that ROOT_URL matches the certificate hostname exactly.
• Limit firewall exposure to required ports and disable password SSH login for administrative accounts after key-based access is tested.
• If you enable reverse-proxy authentication, configure trusted proxy addresses explicitly. In v0.14.3, a fix prevents an authentication header from being trusted from arbitrary remote addresses; it is restricted to addresses listed in [auth] TRUSTED_PROXY_IPS.
• Keep the application current. The release listing for v0.14.3 (2026-06-07) records fixes for reverse-proxy authentication trust, SSRF through HTTP redirects, unauthenticated file upload, protected-branch bypass and other defects. Recheck the official releases page immediately before applying these commands because the available version may have changed.

Upgrade without losing repositories

1. Schedule a maintenance window and run gogs backup to off-host storage.
2. Stop Gogs: sudo systemctl stop gogs, or stop the Compose service.
3. Keep custom/conf/app.ini, repository data, attachments and the database untouched.
4. Install the new binary or pin the new image tag, preserving the same paths and UID/GID.
5. Start the service, watch logs for database migrations, and verify login, a web clone, an SSH clone and a push.
6. Retain the prior binary or image tag until the verification window ends, then remove it only after a fresh backup.

Never overwrite the data directory with a clean release archive. The application files and persistent data have different lifecycles.

Troubleshooting common failures

The browser shows 502 Bad Gateway

Check systemctl status gogs and journalctl -u gogs. Confirm Gogs is listening on the address and port used by proxy_pass, that the service account can read app.ini, and that a local curl request succeeds. A mismatch between HTTP_PORT and Nginx’s upstream is the usual cause.

Clone URLs contain the wrong hostname or scheme

Set DOMAIN, SSH_DOMAIN and ROOT_URL to the public hostname, then restart Gogs. Behind TLS-terminating Nginx, retain PROTOCOL = http for the internal listener while using an HTTPS ROOT_URL.

SSH works for administrators but not for repositories

Confirm that the public port in SSH_PORT matches the firewall, host forwarding and client command. Check ownership and permissions of the git account’s authorized_keys. If you use the built-in server, verify START_SSH_SERVER, the internal listen port and the container mapping.

Pushes fail with permission or database errors

Inspect the service log, then verify that repository and data directories are owned by git, the database account can connect, and the filesystem is not full. For Docker, inspect volume ownership from inside the container and confirm that the database hostname is the Compose service name.

The restore appears successful but repositories are missing

Stop the service, confirm that the archive was created by the same Gogs installation and includes repositories and related files, and check that the restored paths match app.ini. Correct ownership before restarting and test with an administrator account and a known repository.

Quick Recap

SaleBestseller No. 1

TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black

$13.98

SaleBestseller No. 2

Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)

$17.99

Bestseller No. 3

New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord

[Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable

$8.99

Bestseller No. 4

BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees

$199.99

Bestseller No. 5

Pokemon FireRed and LeafGreen Strategy Guidebook: Affordable & Unofficial Strategy Guide Walkthroughs

$19.98

Operational checklist

• DNS resolves to the VPS and only required ports are open.
• Gogs runs as git, in production mode, with a generated secret key.
• ROOT_URL, DOMAIN, SSH_DOMAIN and port values produce usable HTTPS and SSH clone URLs.
• Nginx passes the original host, client address and protocol and does not expose the backend port.
• The chosen database and every persistent volume are included in an off-host backup.
• A test restore, HTTPS clone, SSH clone and push have all succeeded.
• The installed release has been checked against the current official release listing and proxy trust settings are restricted.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.