Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesThe dependable pattern is a supported Linux VPS, a non-root administrator, key-only SSH, a narrowly scoped firewall, HTTPS for the web interface, and a forge such as Gitea or GitLab Self-Managed. Keep Git data and backups separate from the VPS disk, and test a restore before you trust the server with important code.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
For a personal project or small team, Gitea usually offers the lighter operational footprint. Choose GitLab Self-Managed when integrated CI/CD, registries, and broader project-management features justify more memory, storage, upgrade work, and backup complexity.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What a private Git server on a VPS actually provides
A private Git server is a self-hosted forge: software that stores repositories and provides authentication, permissions, a web interface, pull or merge requests, issues, and related collaboration features. The VPS supplies the compute, disk, network address, and operating-system environment; the forge supplies Git hosting.
Private does not mean invisible. The server still has a public IP address or DNS name, so anyone who can reach its exposed services can attempt authentication. Privacy comes from repository visibility settings, account controls, firewall rules, encrypted transport, and disciplined administration.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
A practical architecture has four layers:
- VPS and operating system: a currently supported Linux image with security updates.
- Network controls: the provider firewall and, where appropriate, a host firewall that expose only required services.
- Forge: Gitea or GitLab Self-Managed, running under its own service account and using its documented database and storage layout.
- Client access: HTTPS for the web UI and API, plus Git-over-SSH on the selected SSH path.
Keep the provider console or recovery path available. A firewall or SSH mistake should not permanently lock you out of the machine.
Choose Gitea or GitLab Self-Managed
There is no universal winner. The right choice depends on the features you need and how much administration your team can sustain.
| Decision area | Gitea | GitLab Self-Managed |
|---|---|---|
| Best fit | Personal projects and small teams that want a focused forge | Teams that need integrated CI/CD, registries, and extensive project-management features |
| Operational footprint | Generally lighter and simpler to operate | Greater resource and operational overhead |
| Configuration focus | Focused SSH and HTTPS controls | Detailed hardening, SSH, backup, and platform controls |
| Access model | Repository and account permissions for a compact forge | Deeper authentication, access-control, collaboration, and automation options |
| Backup planning | Back up the forge database, repository data, configuration, and any enabled attachments or objects | Backups can include database data, configuration, repositories and LFS objects, artifacts and job logs, registries, wikis, uploads, and other project data; Redis, object storage, configuration files, and TLS or SSH keys may require separate handling |
| Upgrade burden | Usually more manageable for a small installation | More involved because more integrated services and data types must remain compatible |
Use the current official installation path for whichever forge you select. Do not copy an old, version-specific command from an unrelated tutorial. Record the exact forge version, database choice, data directory, and service account as soon as the installation is complete; those details determine later upgrade and recovery steps.
Plan the VPS before installing anything
Choose a supported base system
Select a Linux image that is currently supported by your VPS provider and by the forge version you intend to run. Apply operating-system updates before exposing the forge to the internet, and continue patching on a defined schedule. A current image reduces the chance that you begin with an already obsolete kernel, library, or cryptographic component.
Assign a stable name
Attach a domain or subdomain such as git.example.com to the VPS’s static public address. The forge’s canonical URL must use this name. Consistency matters: links in repository pages, clone URLs, webhooks, OAuth callbacks, and certificate requests all depend on the canonical address.
Create an administrative identity
Create a named, non-root account with sudo rights. Confirm that you can log in with your own key before changing SSH policy. Keep a second tested administrative path or the provider’s console available while you harden the machine.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use key-based administration
Generate an Ed25519 key on each administrator’s client where supported. Protect the private key with a passphrase and upload only the public key to the VPS. Never paste a private key into the forge or into a web form. After confirming key login in a new session, disable password-only administration; do not make this change first and discover afterward that the key was installed incorrectly.
Open only the network paths you need
Implement firewall rules before publishing the forge. GitLab’s hardening guidance states that, for basic usage, only TCP ports 80 and 443 need to be open for web access. Git-over-SSH also needs the SSH port you choose, while administrative SSH should be limited to trusted source addresses whenever feasible.
| Service | Port or path | Exposure guidance |
|---|---|---|
| HTTPS forge UI and API | TCP 443 | Public, because clients need to clone, browse, and use the API over encrypted HTTPS |
| HTTP | TCP 80 | Open only when needed to redirect to HTTPS or complete certificate issuance |
| Git over SSH | Your selected SSH port | Expose for SSH cloning and pushing; keep the administrative account and forge SSH path distinct in policy |
| Administrative SSH | Your administration port | Restrict the source range to trusted addresses where your network allows it |
The exact firewall interface varies by provider and distribution, so apply the provider’s current firewall rules and mirror them in the host firewall if you use one. Do not open database ports, cache services, or internal forge services to the public internet unless the product’s documented architecture explicitly requires it.
Install the forge without creating a maintenance trap
- Read the current installation requirements. Confirm supported operating systems, database choices, storage needs, required runtime packages, and the release you will maintain.
- Install from the official method. Use the current Gitea or GitLab Self-Managed procedure rather than an old one-line script or a command written for another release.
- Use a dedicated service identity. The forge should not run as root. Keep its data directory, configuration, and logs identifiable and protected from ordinary users.
- Record the deployment inventory. Write down the forge version, database engine and version, service account, data directory, external storage locations, canonical URL, and the system services used to start it.
- Verify local operation first. Before opening public access, confirm that the service starts after a reboot, the database is reachable only where intended, and the provider firewall permits the expected traffic.
Gitea exposes focused SSH and HTTPS configuration controls. GitLab publishes more extensive hardening and operational procedures. In either case, treat upgrades as planned maintenance: read the release notes, preserve a tested backup, and schedule downtime or rolling work according to the product’s current guidance.
Configure the canonical URL and HTTPS
Set the public URL
Set the forge’s canonical URL to the DNS name, for example https://git.example.com. Do not leave the service advertising an internal hostname or the VPS IP address. Incorrect canonical settings produce clone URLs that fail for users and can break webhook or authentication callbacks.
Choose a TLS termination design
Gitea supports built-in HTTPS with a certificate and key. Its documentation also describes a reverse-proxy arrangement in which the proxy is the public TLS endpoint while Gitea remains on a private network. Either design can be sound:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Built-in TLS: fewer moving parts, with the forge directly handling the certificate and encrypted connections.
- Reverse proxy: the proxy owns public TLS and forwards traffic to Gitea on a private interface, which can simplify certificate management and let other internal services share the proxy.
Use a publicly trusted certificate for normal client access. Reserve self-signed certificates for controlled evaluation, where every client can be configured to trust the private certificate. Ensure HTTP redirects to HTTPS when port 80 is enabled, and make sure the proxy forwards the original host and scheme so the forge generates secure URLs.
Plan renewal and failure handling
Document who renews the certificate, where the certificate and private key are stored, and how the forge or proxy reloads them. Test renewal before the first certificate expires. Include TLS keys in your protected backup plan; a repository backup without the keys and configuration may not restore the service’s identity or HTTPS endpoint.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Set up secure Git-over-SSH access
Generate and protect client keys
- On each client, generate an Ed25519 key where the operating system supports it, using a distinct filename for this forge if you already have other keys.
- Protect the private key with a strong passphrase and load it into your local SSH agent or operating-system key store.
- Upload only the public key through the forge’s account settings. The private key stays on the client and should never be pasted into the web interface.
- If your organization uses hardware-backed keys, GitLab documents ED25519_SK and ECDSA_SK variants. ED25519_SK requires OpenSSH 8.2 or later on both the local client and the Git server.
GitLab describes Ed25519 as preferred because it is more secure and performant than RSA keys. Compatibility still matters: verify the OpenSSH versions on both ends before standardizing on a hardware-backed variant.
Verify the server identity
Before the first push, verify the server host-key fingerprint through a trusted channel. This prevents accepting an impostor host during a first connection. Store the verified fingerprint in your team’s onboarding documentation and investigate unexpected changes rather than automatically accepting a new key.
Test the forge’s SSH endpoint
Use the test command documented by your forge and confirm that it identifies your account without opening a shell. Then clone a private test repository, create a small commit, push it, and verify that the web interface shows the commit. Test from a second account with read-only permissions to confirm that authorization, not just authentication, is working.
Create private repositories and least-privilege access
Start with private visibility
Create repositories as private by default. Make a repository public only after an owner has reviewed its history, issues, attachments, deployment keys, and accidentally committed secrets. Changing visibility does not remove sensitive data from old commits; rotate exposed credentials and rewrite history when necessary.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use groups and roles deliberately
Add people through groups where the forge supports them, then assign the least-privilege role that permits their work. Separate owners, maintainers, contributors, and read-only reviewers. Test that a read-only account cannot push, change settings, add deploy keys, or alter protected branches.
Review secondary access paths
Repository permissions are only one part of the attack surface. Review deploy keys, personal access tokens, webhooks, CI runners, and any external integrations separately. Give each token the smallest scope and shortest useful lifetime. Remove keys and tokens when a person, machine, or integration leaves the project.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Back up the forge independently of the VPS
A snapshot of the VPS disk is not a complete backup strategy. It can preserve a damaged system, the same accidental deletion, or the same encryption event. Schedule the forge’s supported backup command and copy its output to storage that is not the VPS disk. Encrypt the backup, restrict access, retain multiple generations, and keep an off-site or offline copy.
Capture every data class
GitLab states that its archive can include database data, configuration, repositories and LFS objects, artifacts and job logs, registries, wikis, uploads, and other project data. It also states that Redis, object storage, configuration files, and TLS or SSH keys may need separate backup handling. Map the same categories to your actual installation:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Repository data: Git history, branches, tags, hooks, and repository metadata.
- Large-file data: Git LFS objects, if enabled.
- Forge state: database, configuration, uploads, wikis, issues, and user or group metadata.
- Automation data: CI artifacts, job logs, runners, and container or package registries where used.
- External services: object-storage buckets, Redis data where required, and any separately managed database.
- Cryptographic identity: TLS certificates and keys, SSH host keys, and secrets needed to reconnect integrations.
Keep backup credentials separate from the VPS credentials. A backup job that writes to a directory on the same disk protects against only a narrow set of failures.
Set retention and monitoring
Retain several generations so an unnoticed corruption or deletion is not copied forever. Monitor backup completion, output size, destination capacity, and encryption status. Alert when a scheduled job fails rather than discovering the failure during an incident.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Prove that recovery works
A backup that has never been restored is an unverified assumption. Perform a restore rehearsal on a separate instance rather than experimenting on production.
- Provision an isolated VPS or temporary recovery environment with a supported operating system.
- Install the same forge release, database type, and major configuration components recorded in your deployment inventory.
- Restore the database, repositories, LFS objects, configuration, uploads, artifacts, registries, and other enabled data classes.
- Restore the required TLS and SSH keys according to your security policy, or deliberately issue replacement certificates and document the change.
- Verify repository history, branches, tags, permissions, private visibility, LFS downloads, webhooks, and CI records.
- Confirm that users can authenticate, clone, fetch, and push according to their assigned roles.
- Document the DNS change, certificate renewal, firewall rules, and exact commands or UI paths used during recovery.
Record the elapsed recovery time and any missing data. The result gives you a realistic recovery procedure instead of a theoretical one.
Recommended Free Tools
Operate the server safely after launch
Patch on a schedule
Patch the operating system and forge on a defined schedule, and apply urgent security fixes sooner. Read upgrade notes for database migrations, runner compatibility, storage changes, and backup requirements. Keep the provider console available during upgrades that alter SSH, networking, or boot services.
Watch storage and service health
Git repositories grow through history, LFS objects, artifacts, job logs, uploads, wikis, and registries. Monitor disk growth and alert before the filesystem is full. A full disk can stop the database, prevent pushes, and make a backup job fail at the same time.
Review access after team changes
After each joiner, leaver, role change, or integration change, review group membership, deploy keys, personal access tokens, webhooks, and runners. Remove stale credentials and confirm that private repositories remain private.
Troubleshoot the failures you are most likely to see
The web interface opens but clone URLs fail
- Check that the canonical URL uses the public DNS name and the correct HTTPS scheme.
- Confirm that the certificate covers the hostname and that the proxy forwards the original host and scheme.
- Verify that TCP 443 is allowed by the provider firewall and host firewall.
HTTPS works but SSH clone or push fails
- Confirm that the selected Git SSH port is reachable and is not confused with the administrative SSH port.
- Check that the public key is attached to the correct forge account and that the client is offering the intended private key.
- Verify the forge’s documented SSH test command and inspect its service logs.
- If using ED25519_SK, confirm OpenSSH 8.2 or later on both client and server.
Users can read a repository but cannot push
That may be the intended result. Check the user’s role, group membership, protected-branch rules, and whether the clone uses the account whose key or token you tested. Use a deliberately read-only account to validate that the restriction is effective.
Backups complete but restore is incomplete
Compare the restore inventory with the live installation. Missing LFS objects, artifacts, uploads, registries, object storage, Redis data, configuration, or TLS and SSH keys are common signs that only the primary archive was copied. Update the backup job and repeat the isolated restore test.
Launch checklist
- Supported Linux image selected and fully patched.
- Static public address or stable DNS name assigned.
- Named non-root sudo administrator created.
- Key-based administration tested in a second session.
- Password-only administration disabled only after key login was confirmed.
- Provider firewall enabled before public exposure.
- TCP 443 open; TCP 80 open only for redirects or certificate issuance.
- Git SSH port exposed deliberately; administrative SSH restricted where feasible.
- Forge installed from its current official procedure and version recorded.
- Canonical URL set to the DNS name.
- Trusted HTTPS certificate installed, with renewal documented.
- Private repositories, least-privilege roles, deploy keys, tokens, webhooks, and runners reviewed.
- Supported backup scheduled to independent encrypted storage.
- Multiple backup generations and an off-site or offline copy retained.
- Restore rehearsal completed on a separate instance.
- Disk growth, service health, patching, and access reviews assigned to an owner.
Bottom line
For most personal projects and small teams, deploy Gitea behind a tightly scoped firewall and trusted HTTPS, then protect Git-over-SSH with passphrase-protected Ed25519 keys. Move to GitLab Self-Managed when its integrated CI/CD, registries, and deeper project controls are worth the additional resources and administration. Whichever forge you choose, independent encrypted backups and a tested restore are what turn a private VPS installation into a dependable Git service.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
