Recommended Free Tools
To self-host Gerrit on an Ubuntu VPS, install the Gerrit WAR and Java 21 in a persistent site directory, initialize production authentication, bind Gerrit to loopback, and put Nginx or Apache in front of it for public HTTPS. Keep the VPS firewall closed to the Gerrit backend port, authenticate collaborators before they push, and back up repositories, NoteDb review data, configuration, and plugins to storage separate from the server.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The procedure below separates the parts Gerrit documents directly from operational choices you must validate on your Ubuntu release and selected Gerrit version.
As an Amazon Associate I earn from qualifying purchases.
What “self-hosted Gerrit” means
In a self-hosted installation, you operate the complete service rather than using a managed Git platform. The Ubuntu VPS is yours to administer: you select the Gerrit release, install its Java runtime, maintain the site directory, control network exposure, configure identity and access, apply upgrades, and design the backup and recovery process.
A useful production layout has four layers:
Internet
|
Public DNS name
|
Nginx or Apache (TLS termination on 443)
|
Gerrit listener on 127.0.0.1 (private port)
|
Repositories, NoteDb metadata, configuration and pluginsGerrit can serve HTTP directly, but the official configuration guidance strongly encourages a reverse proxy for externally facing production sites so that the proxy handles SSL/TLS and Gerrit uses a proxy-https:// listener. The proxy also gives you one place to manage certificates, public headers, access logging, and the firewall boundary.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Plan the VPS before installing anything
Use a dedicated administrative and service identity
Create a normal Ubuntu account for administration and use sudo for privileged work. Run Gerrit itself under a dedicated service identity rather than your personal login. This limits the damage from a compromised process and makes ownership of the site directory, repositories, logs, and plugins unambiguous.
Choose a persistent directory such as /var/lib/gerrit-site. Do not place the site under a temporary directory or inside an administrator’s home directory that may later be removed or have restrictive permissions changed.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Choose a stable hostname and DNS record
Assign a fully qualified name such as review.example.net and point its DNS record to the VPS address. Use that same public name when configuring the reverse proxy and when teaching collaborators the SSH or HTTPS clone URL. A certificate is issued for names, not for an arbitrary future alias, so settle the public name before requesting TLS.
Install the Java runtime required by the release
The current Gerrit standalone installation guide documents JRE version 21 as a host requirement for its release line: “To run the Gerrit service, the following requirement must be met on the host: JRE, version 21.” Select the Gerrit release first, then verify its installation page and install the matching Java runtime. Do not assume that a different JRE major version will work merely because it starts a Java process.
On Ubuntu releases that provide it, the headless package is commonly installed with:
sudo apt update
sudo apt install openjdk-21-jre-headlessConfirm the runtime before initializing Gerrit:
java -versionIf your Ubuntu repository does not provide that package, use a supported JRE 21 source for your Ubuntu release and verify the resulting java -version. Keep one deliberate Java installation on the server; multiple alternatives can cause an upgrade or service manager to run a different runtime than the one you tested.
Size from workload, not a fictitious minimum
The official pages reviewed for this procedure do not publish a universal CPU, RAM, disk, or concurrent-user minimum for an Ubuntu VPS deployment. That omission is important: a small team with a few repositories has a different profile from a large monorepo with heavy indexing and many simultaneous reviews.
- Estimate repository count, object history, and expected growth for disk capacity.
- Account for indexing, repository maintenance, and concurrent reviewers when selecting CPU and memory.
- Leave room for temporary files, logs, snapshots, and an in-place upgrade.
- Monitor disk usage, memory pressure, load, and response time after launch, then resize from observed behavior.
Set the network boundary first
Permit only the public services you intend to operate. A typical single-VPS firewall policy allows SSH administration and web traffic on ports 80 and 443, while the Gerrit backend port remains reachable only from loopback. Replace the SSH rule with your actual administration policy if you use a different port or an external access network.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verboseDo not open the private Gerrit listener to the Internet. A proxy listener trusts forwarded headers; an untrusted client that can reach it may be able to spoof those headers.
Download and initialize Gerrit
Obtain the WAR for the release you selected
Download the desired current WAR from the Gerrit releases site using the release’s official installation instructions. Keep the downloaded file outside the site directory until you have checked its ownership and integrity, then record exactly which release you installed. The site directory will contain mutable repositories and configuration; the WAR is the executable artifact you must retain for a controlled upgrade or rollback.
For the examples below, set a shell variable to the path of the file you downloaded:
export GERRIT_WAR=/tmp/gerrit.war
export GERRIT_SITE=/var/lib/gerrit-siteUse the real paths on your server; these variables are not filenames that Gerrit creates for you.
Create the site directory and service account
sudo adduser --system --group --home /var/lib/gerrit gerrit
sudo install -d -o gerrit -g gerrit "$GERRIT_SITE"
sudo chown gerrit:gerrit "$GERRIT_WAR"If the account or directory already exists, inspect its ownership instead of blindly recreating it. Every file Gerrit must update at runtime should be writable by the service identity, while the service identity should not own unrelated system directories.
Run the initialization workflow
Initialize as the Gerrit service identity:
sudo -u gerrit java -jar "$GERRIT_WAR" init -d "$GERRIT_SITE"Answer the prompts for the public hostname, listener, authentication backend, and any mail or repository options required by your release. Select a production authentication method during this initialization. The exact choices depend on the identity system you intend to use, so document the selected backend and its recovery process before inviting collaborators.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The quickstart command often shown in introductory material is:
java -jar gerrit*.war init --batch --dev -d $GERRIT_SITEThat command is useful for learning because it performs a batch initialization with development authentication. The quickstart page explicitly presents it as a demonstration and directs production users to the standalone installation guide. Do not carry --dev into a public service.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Arrange supervised startup
Run Gerrit under Ubuntu’s service manager or another supervisor that starts it as the dedicated service identity, restarts it according to a deliberate policy, and records logs in a location you monitor. The exact unit and start command vary with the Gerrit release and the way its WAR is packaged; use the selected release’s documented server-start procedure rather than copying an old unit file.
Before exposing the hostname, prove that the service can start after a reboot, that it reads the intended site directory, and that a failed process produces an actionable log entry. Treat the supervisor definition as configuration that belongs in your backup and change records.
Bind Gerrit to a private listener
When the reverse proxy runs on the same VPS, bind Gerrit to a loopback address such as 127.0.0.1. The quickstart recommends changing a wildcard listener to localhost for this reason. A private listener ensures that Internet clients can reach Gerrit only through the proxy, where TLS and header policy are enforced.
Set the HTTP listener in the Gerrit configuration using the proxy scheme that matches the public connection:
[httpd]
listenUrl = proxy-https://127.0.0.1:8080Use proxy-http:// when the public proxy connection is HTTP, and proxy-https:// when the proxy terminates HTTPS for users. The configuration reference warns that proxy listeners trust forwarded information; only the trusted proxy should be able to connect to them. Keep port 8080 (or whichever private port you choose) out of cloud firewall rules and host firewall allows.
Restart the supervised service after changing the listener, then verify locally before adding public DNS:
curl -I http://127.0.0.1:8080/A response, redirect, or authentication challenge confirms that something is listening. A connection refusal means the service did not start, is using another port, or is reading a different site directory.
Put Nginx or Apache in front for HTTPS
Keep the public path identical to Gerrit’s path
Gerrit’s reverse-proxy guidance requires the proxy path and Gerrit’s listenUrl path to agree. The least error-prone design is to publish Gerrit at the root of its hostname, https://review.example.net/, and avoid URI rewriting. If you deliberately publish it under a prefix, configure that prefix consistently in Gerrit and the proxy and test clone, web, archive, and change URLs.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
In Nginx, a proxy_pass without an added URI is a useful starting point because it preserves the incoming path:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsserver {
listen 80;
server_name review.example.net;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2;
server_name review.example.net;
ssl_certificate /etc/ssl/review.example.net/fullchain.pem;
ssl_certificate_key /etc/ssl/review.example.net/privkey.pem;
location / {
proxy_pass http://127.0.0.1:8080;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port 443;
}
}Replace the certificate paths with the files issued for your hostname. Obtain and renew the certificate with the ACME or certificate-management method you already operate, and test renewal before the first certificate expires. The key requirement in the proxy block is not the particular certificate tool; it is preserving the public host and forwarding the client address and scheme accurately.
Do not change the example to proxy_pass http://127.0.0.1:8080/; casually. Adding a trailing URI can rewrite paths, which may break Gerrit URLs when the configured listenUrl expects the original path. If you need rewriting, design and test it intentionally rather than combining a prefix location with an unrelated backend path.
Apache is a valid alternative
The official reverse-proxy documentation also provides Apache examples. Choose Apache when your team already operates it confidently or needs its existing logging and certificate workflow. The same invariants apply:
- TLS terminates at the public proxy unless you intentionally use end-to-end TLS.
- The proxy forwards the original host and client-IP information.
- The external path matches Gerrit’s configured path.
- Only the proxy can reach the private Gerrit listener.
| Decision axis | Nginx | Apache |
|---|---|---|
| TLS termination | Handled at the HTTPS virtual server; certificate paths and renewal remain your operational responsibility. | Handled at the HTTPS virtual host; use the certificate modules and renewal process your team already manages. |
| Header behavior | Set Host, X-Forwarded-For, and scheme headers explicitly. |
Configure equivalent proxy and forwarded-header directives explicitly. |
| Path rewriting | A URI in proxy_pass can rewrite paths; the simplest root mapping preserves them. |
Proxy and rewrite rules can also alter paths; keep the mapping aligned with listenUrl. |
| Logging | Use access and error logs together with Gerrit logs to trace a request. | Use the virtual-host logs together with Gerrit logs for the same purpose. |
| Operational choice | Prefer it when the team already knows its configuration and renewal workflow. | Prefer it when Apache is already the maintained front end on the VPS. |
Validate the public endpoint
- Resolve the public hostname and confirm it points to the intended VPS.
- Open the HTTPS URL and confirm the certificate name matches the hostname.
- Check that an HTTP request redirects to HTTPS if you enabled the redirect server.
- Inspect Gerrit’s log and the proxy access log for the same request.
- Confirm the backend port is not reachable from another machine.
If the page loads but clone URLs contain the wrong host, fix the forwarded host and Gerrit’s public URL settings before users copy them. If links lose a prefix, fix the path mapping rather than adding ad-hoc rewrites to individual locations.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Configure collaborator authentication and uploads
Gerrit supports uploads over SSH and over HTTP/HTTPS. The upload documentation makes the ordering explicit: users must have authentication configured before they can push. Creating a repository or showing its web page does not, by itself, authorize a Git client.
SSH access
- Choose and configure the Gerrit authentication backend during initialization.
- Have each collaborator create an SSH key pair on their own workstation and protect the private key with a passphrase.
- Register the public key with the collaborator’s Gerrit identity through the account mechanism enabled on your server.
- Give the collaborator the SSH clone or push URL generated by Gerrit, including the correct hostname and SSH port.
- Test authentication with a read operation before granting write permissions.
Do not copy private keys to the VPS. If an employee leaves or a key is lost, remove that public key from the Gerrit account and issue a replacement.
HTTP or HTTPS access
HTTP/HTTPS uploads are appropriate when your organization’s identity system and credential policy are built around web access. Configure the selected backend first, then issue the credential form that backend supports. That may be a password, token, or another credential type; the correct choice is release- and backend-dependent. Require HTTPS for every credential-bearing request and never ask users to put secrets directly into a repository URL that can be captured in shell history.
Test both a permitted and a denied operation. A successful clone followed by a rejected push usually means authentication succeeded but the account lacks repository permission; a failed login before the repository is reached points to the identity or proxy configuration.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchChoose an upload protocol deliberately
| Protocol | What the user needs | Typical failure to diagnose |
|---|---|---|
| SSH | Registered public key, correct SSH URL, and repository permission. | Key is not attached to the expected identity, or the URL uses the wrong host or port. |
| HTTP/HTTPS | Web authentication configured, a supported credential, HTTPS, and repository permission. | Credential is rejected, proxy headers or path are wrong, or the account is authenticated without write access. |
Back up Gerrit before inviting users
A Gerrit backup is more than a copy of bare Git objects. Modern Gerrit stores review state in NoteDb metadata inside the Git repositories, so a repository backup must preserve that metadata along with the code and history. A recoverable backup set should include:
- All Git repositories, including the metadata that records reviews and related state.
- The site’s
etcconfiguration and secrets, protected as sensitive data. - Installed plugins and any plugin-specific configuration or data they require.
- Other required data directories identified by the selected release and plugins.
- The reverse-proxy configuration and certificate-renewal configuration needed to recreate the public endpoint.
Search indexes and caches can generally be rebuilt, so they are not equivalent to repository or configuration data. Retaining them can shorten recovery, but never discard the authoritative repositories or secrets merely because an index backup is easier.
Create a consistent snapshot
Files that change during a live write can produce a backup that looks complete but cannot be restored reliably. Use a filesystem snapshot, storage-level snapshot, or another consistency method that your platform documents. Coordinate the snapshot with Gerrit’s operational guidance for the release, and record the exact time, site-directory state, and configuration version.
After the snapshot is complete, archive it to storage separate from the VPS. A second disk attached to the same virtual machine does not protect against deletion of the VPS, provider failure, or a destructive credential compromise. Keep retention periods that match your recovery and audit requirements, encrypt sensitive archives, restrict access, and test that a new machine can read them.
Free tools Windows power users keep installed
One-click scans. No signup required.
Test restoration, not just backup creation
- Provision a clean Ubuntu test host with the Java runtime required by the Gerrit release.
- Restore the site directory, configuration, plugins, and repositories using the documented ownership and permissions.
- Start Gerrit on a private listener and verify that projects, branches, changes, comments, and permissions are present.
- Rebuild indexes or caches that you intentionally excluded from the snapshot.
- Place a temporary proxy in front of the restored instance and test HTTPS, SSH authentication, and an authorized push.
- Record the elapsed recovery time and any manual steps, then update the runbook.
Do not expose the restored test service under the production hostname until you have confirmed that its authentication and outbound notifications cannot reach real users.
Operate and update the VPS safely
Monitor the failure modes that matter
- Disk growth for repositories, logs, temporary files, and snapshots.
- Memory pressure and CPU load during indexing, repository maintenance, and review peaks.
- Proxy errors, certificate expiry, and increases in upstream response time.
- Gerrit authentication failures and unexpected permission changes.
- Backup completion, archive age, and restoration-test results.
Keep proxy and Gerrit logs time-synchronized so one request can be followed across both layers. Alert on a failed backup and on low free disk space; waiting for users to report a 500 response is not an adequate monitoring plan.
Use a change window for upgrades
Before upgrading, read the target release’s installation and upgrade notes, verify its Java requirement, confirm that every installed plugin supports the target release, and take a fresh tested backup. Schedule a maintenance window, preserve the previous WAR and configuration for rollback, and check repository browsing, authentication, clone, and push operations after the service returns.
The Ubuntu service definition, firewall rules, proxy configuration, certificate files, and backup jobs are part of the deployment even though they are outside the Gerrit site directory. Version or otherwise record them so that a replacement VPS can be rebuilt without relying on one administrator’s memory.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Troubleshoot by symptom
| Symptom | Likely layer | Checks and corrective action |
|---|---|---|
| Connection to the public hostname times out | DNS, cloud firewall, or host firewall | Check DNS resolution, VPS security rules, UFW status, and whether the proxy is listening on 443. |
| Proxy returns 502 or 503 | Gerrit process or private listener | Inspect the supervisor and Gerrit logs, confirm the process is running as the service identity, and verify the configured loopback port with a local request. |
| Certificate warning | Certificate or hostname | Check that the certificate covers the exact public name, that the proxy serves the intended certificate, and that renewal has not failed. |
| Page opens but links use the wrong host or scheme | Forwarded headers or public URL | Preserve Host, send the correct X-Forwarded-Proto, and confirm the proxy path agrees with listenUrl. |
| Assets or change links lose a URL prefix | Path rewriting | Remove unintended URI rewriting or configure the same prefix on both proxy and Gerrit; test root and nested paths. |
| SSH login is denied | Identity or SSH URL | Confirm the public key is attached to the intended account, the URL uses the correct hostname and port, and that the account has project access. |
| HTTPS push asks for credentials repeatedly | HTTP authentication | Verify the credential type supported by the configured backend, use HTTPS, and check proxy logs for authentication failures. |
| Push authenticates but is rejected | Repository authorization | Review the account’s project and branch permissions; successful authentication does not imply write access. |
| Restore starts but reviews are missing | Incomplete backup | Confirm that the repository backup included modern NoteDb metadata and that the restored configuration and plugins match the source instance. |
A production-readiness checklist
- Selected Gerrit release and verified its documented JRE requirement, including JRE 21 for the release line covered by the current standalone guide.
- Dedicated service identity owns the persistent site directory.
- Production authentication selected; development authentication is not enabled on the public service.
- Gerrit listens on loopback, and its backend port is blocked from external networks.
- Nginx or Apache terminates HTTPS, preserves the host, forwards client-IP and scheme headers, and uses an intentionally matched path.
- HTTP redirects to HTTPS if that is your chosen public policy.
- At least one collaborator has completed an authenticated read test and an authorized push test.
- Backups include repositories with review metadata, configuration and secrets, plugins, and required data directories.
- Snapshots are archived away from the VPS, encrypted where appropriate, and periodically restored on a clean host.
- Logs, disk growth, certificate renewal, service health, and backup jobs are monitored.
- An upgrade and rollback runbook exists for the WAR, Java runtime, plugins, proxy, and Ubuntu service configuration.
That design keeps Gerrit itself private, gives collaborators a normal HTTPS and SSH entry point, and makes recovery a documented operation instead of an assumption.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
