Spring til indhold
SIAX
Denne sprogversion er et maskinstøttet udkast, som ikke er gennemgået. Den indekseres ikke af søgemaskiner. Læs den gennemgåede engelske version
SikkerhedshærdningIkke gennemgået

Harden a self-hosted Gitea: app.ini settings to check

A checklist of Gitea configuration settings that matter for security after installation (installer lock, secrets, registration, sign-in, passwords, proxy trust), with the defaults stated in the Gitea configuration cheat sheet.

Endnu ikke oversat: vises på engelsk.

Denne vejledning er endnu ikke gennemgået af en person. Kontroller hvert trin mod den linkede dokumentation, før du stoler på den. Den indekseres ikke af søgemaskiner.Bemærkning fra gennemgangen: Written by an agent from the current (unpinned) cheat sheet; defaults can differ in the Gitea version you run. Needs a person to check against a pinned release and review.

Kontrolleret

Kontrolleret mod

  • Gitea configuration cheat sheet: unpinned (current docs on 2026-10-29) [cheat-sheet]

Før du går i gang

  • A Gitea instance you administer, and access to its app.ini configuration file.

Lock the installer

[security] INSTALL_LOCK controls access to the installation page; when it is true, the installation page is not accessible. The documented default is false. Make sure it is true once the instance is set up.[cheat-sheet]

[security]
INSTALL_LOCK = true
Kilde: Gitea documentation: configuration cheat sheet

Protect and back up the secrets

[security] SECRET_KEY is generated at install. The documentation calls it very important: data encrypted with it, such as two-factor secrets, cannot be recovered if it is lost. Keep app.ini out of version control and include it in your backups.[cheat-sheet]

Who can register and see what

  1. [service] DISABLE_REGISTRATION: when true, only an admin can create accounts. Check the value in your app.ini rather than relying on a default.
  2. [service] REQUIRE_SIGNIN_VIEW (default false): set it to true to force users to sign in to view any page or use the API, for instances that should not be public.
  3. [service] DEFAULT_KEEP_EMAIL_PRIVATE (default false): set it to true to keep new users' email addresses private by default.
[cheat-sheet]

Password rules

[security] MIN_PASSWORD_LENGTH sets the minimum length for new users (documented default 8). [security] PASSWORD_COMPLEXITY is a comma-separated list of required character classes (documented default off).[cheat-sheet]

URL, reverse proxy and SSH

  1. [server] ROOT_URL: set the public URL (https) users reach the instance on; the default is built from PROTOCOL and HTTP_PORT on localhost.
  2. [security] REVERSE_PROXY_TRUSTED_PROXIES (default 127.0.0.0/8,::1/128): list only the addresses of proxies you actually run in front of Gitea.
  3. [server] DISABLE_SSH (default false): set it to true if you do not offer Git over SSH.
[cheat-sheet]

Dækkes ikke af denne vejledning

  • Operating-system hardening, firewalls, TLS certificates and backups of the database and repositories.
  • Settings for migrations and mirrors (which hosts Gitea may fetch from): they changed between versions; read the cheat sheet for your version.

Kilder

Udforsk hele websitet · Svenska