Host your own Git server: SSH and Gitea
You build an in-house Git server, from bare repositories over SSH to Gitea with a web interface, and secure, back up and restore it.
Level 401 · 15 lessons · 12 practice labs
Lessons
A Git server over SSH
- Bare repositories and shared repository permissions
- A restricted Git user with git-shell
- Per-key repository access: authorized_keys restrictions
- git daemon and smart HTTP: when and how safe
- Short task: set up an SSH Git server with separate rights for two teams
Gitea
- Installing Gitea, its database and the first admin
- Organisations, teams and repository permissions
- Branch protection, required review and signed commits
- Webhooks and server-side hooks
- Short task: migrate the repositories from the SSH server into Gitea
Running it
- Backing up and restoring the Git server
- Mirror repositories and a second location
- Reviewing access logs and rotating keys
- Short task: the server died: restore from backup and verify
Wrap-up
- Capstone: build a backed-up, audited Git service for the company
Practice labs
- A Git user with no shell: Restrict the server’s git user with git-shell and show that the same key can push but an interactive SSH session is refused.
- A key that can read only one repo: Limit the deploy server’s key with authorized_keys restrictions so it can only read one repository, and prove access to other repositories and writes are refused.
- Permission chaos in a shared repo: Repair the wrong group permissions that appeared after a push in the bare repository two teams use, set lasting sharing settings and show alternating pushes from two users succeed.
- A read-only team: Create an auditors team in Gitea for the Harborview Hospital organisation, give it read-only access to two repositories and show a push from an auditor account is refused.
- Find over-privileged accounts: Dump every user’s admin flag and team permissions through the Gitea API, fix permissions that don’t match the role table and list your changes.
- Close a leaving employee’s access: Remove a departing developer’s Gitea access tokens, SSH keys and team memberships, transfer the repositories they own and show an API call with the old token is refused.
- A protection rule for main: Set up a protection rule in Gitea that blocks direct pushes to main and requires a pull request, and show a direct push attempt is refused.
- A webhook that never delivers: Find from the delivery log why the webhook fails on every push (address, secret or allowed host list), fix it and show a successful delivery.
- A branch closed to unsigned, unapproved changes: Protect the release branch so it needs signed commits and two approvals, add an extra check with a server-side hook, and prove with three attempts that an unsigned change gets in by no route.
- Take and inspect a Gitea backup: Take a full Gitea backup, list that the archive holds the database, repositories and configuration, and record the backup’s size and date in a report.
- A mirror at a second site: Keep the critical repository in sync with a second server through an automatic push mirror, push a new commit and show with ls-remote that the mirror reached the same commit.
- A suspicious key in the logs: Find the key used from an unusual source in the SSH and Gitea access logs, work out which repositories it touched, rotate it and prove the old key is now refused.
About this course
You build an in-house Git server, from bare repositories over SSH to Gitea with a web interface, and secure, back up and restore it.
What you will learn
- A Git server over SSH
- Gitea
- Running it
- Wrap-up
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.