0 Followers
0 Following
8 Posts
Yes, hosting the site seems much safer (at least in theory) since I am proxying it through cloudflare and I am planning on putting ngynx too on top of that this afternoon
A good suggestion, but it would still be hasslesome to setup. Plus, my friend would have to connect to the vpn whenever he wants to push/pull the repo
Yes, or else I wouldn’t have access to the web interface haha
I’d rather not say which router I have since it would reveal quite a bit of information about me. However, I do know that the connections that my router allows are tcp and udp
That’s also a possibility, yes. Probably what I should do, taking the rest of the answers into account

I see, only allowing established traffic to connect sounds like something that could work. But I don’t know how I can do this, do you have some pointers :)?

Blocking outgoing traffic and having to whitelist forgejo seems a bit extreme though

The reason why I am asking this question is because I think that the ssh port I am opening only has access to my repos (which means that even if I somehow get hacked the damage is minimal) and it doesn’t accept any keys aside from mine and my friend’s, which we set up through the web interface :).

I have wireguard setup and I’d also thought about sharing a tunnel with my friend, but it seemed much more hasslesome than simply opening the port, not to mention the fact that if anyone wanted to join too I’d have to do that again.

It is exactly because I am afraid of getting fucked that I am asking this and being careful. For now, my idea is to only open the port when someone is about to use it, since I am not absolutely sure that it won’t somehow accept a request from a person with less than noble intentions.

Reverse proxying was also my intention at first, but I just couldn’t get it to work with cloudflare for some reason!

Thanks for the insight!

I am still very much a noob to self-hosting, but I am not the one managing this ssh port, forgero is. Is there not any difference between the two? I think you can only access the forgejo ssh if you have a matching private key for one of the user’s public keys…

Is it safe to open a forgejo git ssh port in my router?

https://lemmy.world/post/15860174

Is it safe to open a forgejo git ssh port in my router? - Lemmy.World

Hello all! Yesterday I started hosting forgejo, and in order to clone repos outside my home network through ssh://, I seem to need to open a port for it in my router. Is that safe to do? I can’t use a vpn because I am sharing this with a friend. Here’s a sample docker compose file: version: "3" networks: forgejo: external: false services: server: image: codeberg.org/forgejo/forgejo:7 container_name: forgejo environment: - USER_UID=1000 - USER_GID=1000 - FORGEJO__database__DB_TYPE=postgres - FORGEJO__database__HOST=db:5432 - FORGEJO__database__NAME=forgejo - FORGEJO__database__USER=forgejo - FORGEJO__database__PASSWD=forgejo restart: always networks: - forgejo volumes: - ./forgejo:/data - /etc/timezone:/etc/timezone:ro - /etc/localtime:/etc/localtime:ro ports: - "3000:3000" - "222:22" # <- port 222 is the one I'd open, in this case depends_on: - db db: image: postgres:14 restart: always environment: - POSTGRES_USER=forgejo - POSTGRES_PASSWORD=forgejo - POSTGRES_DB=forgejo networks: - forgejo volumes: - ./postgres:/var/lib/postgresql/data And to clone I’d do git clone ssh://git@<my router ip>:<the port I opened, in this case 222>/path/to/repo Is that safe?

Wow, buying a big monitor sounds like an idea that could work. I’d never even thought about doing that, since most of the times monitors like those are used, as far as I have seen, to get a better multitasking experience and I am the type of person who simply leaves one fullscreen window open at the time. But if it leaves your peripheral vision, I guess it is definitely possible.

I don’t think it’d work for me, but honestly, sounds like a great idea to have in mind! I’m having a lot of fun learning about different people’s workflows like this.