Self-Hosted Git: Forgejo, Gitea, GitLab — Workflow, CI, Backup

Why host your own forge

Privacy, air-gapped networks, large LFS, or refusing a single SaaS for every repo. Mirror critical repos off-site anyway — a basement forge is not a backup by itself.

Right-size: Forgejo vs Gitea vs GitLab CE

Forgejo and Gitea are the same lightweight class; day-to-day UI is similar — choose the release/security stream you trust. GitLab CE earns weight when pipelines and registry are daily needs, not because the installer looks serious.

Repository hosting baseline

services:
  forgejo:
    image: codeberg.org/forgejo/forgejo:9.0.3
    environment:
      USER_UID: "1000"
      USER_GID: "1000"
    volumes:
      - ./forgejo:/data
    networks: [internal]
    restart: unless-stopped
  db:
    image: postgres:16-alpine
    volumes: [pgdata:/var/lib/postgresql/data]
    networks: [internal]
    restart: unless-stopped

Terminate TLS at your reverse proxy. Disable open registration. SSH on a deliberate port or VPN-only.

[Add real environment data here]
Forge (Forgejo/Gitea/GitLab) + version:
DB:
Public clone URL pattern:
SSH path:
Runner host (if any):

Issues and permissions

Use orgs to separate homelab infra from personal projects. Protect default branches on important repos. Prefer SSH keys; disable password git auth.

CI and runners

Optional Actions/runners for linting compose or small builds. Isolate runners; assume a malicious workflow can read secrets exported to that runner. Store CI secrets in the forge secret store — not in plaintext workflow files.

Household forges often disable public signup and outside PRs — boring and sufficient until you invite collaborators.

Authentication

Local users + MFA for admins is enough to start. OIDC (Authentik/Keycloak/Authelia ecosystem) when you outgrow local accounts — document a break-glass local admin before SSO-only login.

Backup

Backup DB + `/data` (repos, wiki, attachments, packages) together. Bare `git bundle` is not the whole product.

# pattern — adjust names
docker compose exec -T db pg_dump -U git git > backup-$(date +%F).sql
tar czf forge-data-$(date +%F).tgz -C /srv/compose/forge data

Test restore on scratch compose: clone one repo and open one issue attachment.

Migration

Trial import with labels/milestones/LFS before switching laptop remotes. Keep old remotes read-only for a while. Inventory CI variables before exposure changes; rotate tokens after migration.

Related reading

See Docker Compose hardening, Automatic SSL certificates, Restore drill playbook, Secure remote access, and Open-source licenses quick guide.