self-host github with forgejo for $0 in one container

why your code doesn't need to live on someone else's server

github is great until it isn't. outages happen, accounts get suspended for dumb reasons, and every private repo you push is sitting on infrastructure you don't control. if you've got a homelab or even just a spare raspberry pi, you can run your own git server in about five minutes. this is forgejo, a fully open source fork of gitea, and it does basically everything github does for your personal workflow. zero dollars, one container, your rules.

spinning it up

here's the whole install:

docker run -d --name forgejo -p 3000:3000 codeberg.org/forgejo/forgejo:latest

breaking that down:

docker run -d starts the container in detached mode so it runs in the background instead of hogging your terminal.

--name forgejo gives the container a name so you're not referencing it by some random hash later when you want to stop or update it.

-p 3000:3000 maps port 3000 on your machine to port 3000 inside the container, which is where forgejo's web ui lives. you'll hit it in a browser at your server's ip, not localhost, if you're running this on a homelab box.

codeberg.org/forgejo/forgejo:latest pulls the image straight from codeberg's registry instead of docker hub. that's intentional, forgejo is a community project that split off from gitea specifically to stay independent, so they host their own images.

that's it. that's the whole server. the attack surface here is tiny compared to running a vps with a hundred open ports, which is exactly the point.

the setting that matters more than anything else

the second this thing is up, go into admin settings and find DISABLE_REGISTRATION and set it to true. this is not optional. an unauthenticated git server sitting on the open internet with registration enabled is an invitation for bots to sign up and start poking around, mining it for spam repos, or worse, using it as a foothold. you are the only user. there should never be a "sign up" button visible to anyone but you.

if you forget this step, the rest of this hardening doesn't matter, because you've left the front door unlocked while bolting the windows.

keep it off the public internet entirely

the single biggest thing you can do to defend this setup is to never expose port 3000 to the open web in the first place. there's no reason your git server needs a public ip. two solid options:

lan only. if you only ever push code from devices at home, bind it to your local network and call it done. no port forwarding on your router, period.

vpn access. if you want to push from your laptop while you're out, put forgejo behind a vpn like wireguard or tailscale. you connect to your home network first, then talk to forgejo like it's local. this means even if someone finds your home ip, there's nothing listening for them to attack. the git server effectively doesn't exist to the public internet.

this is the same logic as not exposing your home security camera dashboard to the world. anything self-hosted that doesn't need to be public shouldn't be.

don't put all your eggs in one homelab

self-hosting means you're now responsible for backups, uptime, and disaster recovery. a dead hard drive shouldn't mean a dead project. forgejo supports push-mirroring, where it automatically syncs your repos to a remote like github or codeberg as a backup copy. your primary workflow stays local and private, but you get an offsite copy for free in case your homelab catches fire, gets stolen, or your drive just dies on a tuesday. set it up once per repo and forget about it.

also back up the actual docker volume where forgejo stores its data, not just the git repos. the sqlite or postgres database holds your users, settings, and issue history, and that's not something github mirroring will save for you.

the takeaway

self-hosting git isn't about distrust of github, it's about not depending on a single company for infrastructure you actually need to work. the real security lesson here is bigger than this one tool though: anything you spin up at home, disable open registration immediately, never expose it directly to the internet if you can avoid it, and always have a backup plan that doesn't live on the same disk. do those three things and this $0 setup is more locked down than most paid services you'll ever use.