Siirry sisältöön
SIAX
Tämä kieliversio on konetuettu luonnos, jota ei ole tarkistettu. Hakukoneet eivät indeksoi sitä. Lue tarkistettu englanninkielinen versio
Tietoturvan koventaminenEi tarkistettu

Harden a self-hosted Gitea: app.ini settings to check

A checklist of Gitea configuration settings that matter for security after installation (installer lock, secrets, registration, sign-in, passwords, proxy trust), with the defaults stated in the Gitea configuration cheat sheet.

Ei vielä käännetty: näytetään englanniksi.

Ihminen ei ole vielä tarkistanut tätä opasta. Tarkista jokainen vaihe linkitetystä dokumentaatiosta, ennen kuin luotat siihen. Hakukoneet eivät indeksoi sitä.Tarkistushuomautus: Written by an agent from the current (unpinned) cheat sheet; defaults can differ in the Gitea version you run. Needs a person to check against a pinned release and review.

Tarkistettu

Tarkistettu versioita vasten

  • Gitea configuration cheat sheet: unpinned (current docs on 2026-10-29) [cheat-sheet]

Ennen aloittamista

  • A Gitea instance you administer, and access to its app.ini configuration file.

Lock the installer

[security] INSTALL_LOCK controls access to the installation page; when it is true, the installation page is not accessible. The documented default is false. Make sure it is true once the instance is set up.[cheat-sheet]

[security]
INSTALL_LOCK = true
Lähde: Gitea documentation: configuration cheat sheet

Protect and back up the secrets

[security] SECRET_KEY is generated at install. The documentation calls it very important: data encrypted with it, such as two-factor secrets, cannot be recovered if it is lost. Keep app.ini out of version control and include it in your backups.[cheat-sheet]

Who can register and see what

  1. [service] DISABLE_REGISTRATION: when true, only an admin can create accounts. Check the value in your app.ini rather than relying on a default.
  2. [service] REQUIRE_SIGNIN_VIEW (default false): set it to true to force users to sign in to view any page or use the API, for instances that should not be public.
  3. [service] DEFAULT_KEEP_EMAIL_PRIVATE (default false): set it to true to keep new users' email addresses private by default.
[cheat-sheet]

Password rules

[security] MIN_PASSWORD_LENGTH sets the minimum length for new users (documented default 8). [security] PASSWORD_COMPLEXITY is a comma-separated list of required character classes (documented default off).[cheat-sheet]

URL, reverse proxy and SSH

  1. [server] ROOT_URL: set the public URL (https) users reach the instance on; the default is built from PROTOCOL and HTTP_PORT on localhost.
  2. [security] REVERSE_PROXY_TRUSTED_PROXIES (default 127.0.0.0/8,::1/128): list only the addresses of proxies you actually run in front of Gitea.
  3. [server] DISABLE_SSH (default false): set it to true if you do not offer Git over SSH.
[cheat-sheet]

Tämä opas ei kata

  • Operating-system hardening, firewalls, TLS certificates and backups of the database and repositories.
  • Settings for migrations and mirrors (which hosts Gitea may fetch from): they changed between versions; read the cheat sheet for your version.

Lähteet

Tutustu koko sivustoon · Svenska