Home

I am experimenting with using forgejo instead of GitHub for my personal projects. So far I like it, however I would like to make it available to the outside world at some point.

I was wondering what kind of traps I should avoid. The following things come to mind so far:

• Forgejo Actions seem like a massive potential security risk, however I do not intend to enable sign up for other
• OpenID appears to be a thing for forgejo, I do not know how it works and it seems like it would allow access to my instance even with registering disabled
• I would put the instance behind a nginx as reverse proxy, but how do you keep bot traffic to a minimum? Anubis?

I feel like there are a ton of things I have not thought of, which is why I am holding off on making anything available without a VPN so far.

Yes, Check Anubis, scraper bots follow every link they find and especially git forges basically have infinite links (every single commit and comparison between every single commit and every other).

I haven’t thought it through but there may be some implications on opening port 22 for git via ssh.

Someone posted about git/scrapers here, pretty good read: https://vulpinecitrus.info/blog/guarding-git-forge-ai-scrapers/?ref=selfh.st

If it’s just you, and you’re fine with the regular login… Just disable signup and don’t add more authentication mechanisms like oauth/openID.

I’m using nginx as a reverse proxy as well. For now, I added a lot of “deny” directives to ban all the address ranges from Tencent, Alibaba, OpenAI. It’s not a 100% solution, but works well enough for me. I’m mostly worried about AI crawlers causing too much load on my server.

You can use Forgejo with OIDC or normal login behind a reverse proxy. If you want to make a repo public, you need to add this to your App.ini under the [service] section: REQUIRE_SIGNIN_VIEW = false

Example:

[service]
REGISTER_EMAIL_CONFIRM = true
ENABLE_INTERNAL_SIGNIN = false
ENABLE_NOTIFY_MAIL = true
DISABLE_REGISTRATION = false
ALLOW_ONLY_EXTERNAL_REGISTRATION = true
ENABLE_CAPTCHA = false
REQUIRE_SIGNIN_VIEW = true
DEFAULT_KEEP_EMAIL_PRIVATE = false
DEFAULT_ALLOW_CREATE_ORGANIZATION = true
DEFAULT_ENABLE_TIMETRACKING = true
NO_REPLY_ADDRESS = noreply.localhost
REQUIRE_SIGNIN_VIEW = false

Then you can create a public repo which people can view without an account. You can change visibilty at any time

• oauth, and control sign ups via there. Don’t let people sign up via forgejo itself.
• anubis, yeah. Or similar.
• forgejo actions is an optional component… and forgejo users can bring their own actions server. Of course, it’s a risk to them since the server owner could execute code in actions. But yeah.

I run a forgejo server on the internet for myself so here’s my two cents.

OpenID or any other log in method is just a way to log in to an account on the forgejo server. With registrations disabled it shouldn’t be able to create an account, so there should be no issue. All the extra auth methods also need to be configured and are disabled by default.

Bot traffic can be pretty horrendous once they find your server, I’d say Anubis is basically a requirement at this point. I would also strongly recommend setting up fail2ban for http and ssh, and disabling ssh password auth.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

[Thread #195 for this comm, first seen 28th Mar 2026, 14:10] [FAQ] [Full list] [Contact] [Source code]

Ah I see, I kinda assumed that OpenID would allow anyone with an OpenID server to just log in. That seemed like it would cause immediate spam issues. It would definitely be nice if I could allow users to create issues or stuff like that at some point. I will definitely have to take a look at fail2ban before I make it available. Thank you.

I definitely want to use forgejo actions, but I am mainly worried about random people being able to execute any code on them. Preferably only approved users can do that.

Yes, this has been configured already, thanks for the suggestion.

Do you need to host it yourself? Codeberg is free, and they handle these concerns for you.

But yes, you will need to secure it against hackers and scrapers. Keep user permissions to a minimum, if you allow people to create accounts at all. And run it in a dmz network, so that in case it’s compromised they can’t access the rest of your LAN.

I learned yesterday that Codeberg is free for open-source projects, not closed-source. I believe there are other Forgejo instances that accept closed-source projects though

I don’t need to, but I want to :D

Lots of good answers already. Just want to add.

Block IP from every country that doesn’t have your users in it. That will go a long way.

I run it in a rootless Podman container using Quadlets. Instead of opening the server’s ssh port, I only port-forward the container’s ssh port (e.g. 22 -> 2222). I have sign-ups enabled, since I want people to be able to contribute (or just create issues). But I have configured the server so that nobody can create a repository. They can still fork my repos and send a pull request.

I have yet to experiment with Actions. I assume the safest option would be to only enable it for my own commits, but I am not sure.

It’s been a while since I set up my runner, and I have it on my personal desktop (which is wayyyyyy beefier than the VPS I host my forgejo instance on), but I’m pretty sure I was able to specify that only my user account can trigger actions to be run on this runner. What I’m getting at is that there is a decent amount of granularity for forgejo action permissions; you should be able to find a balance that suits you between “no actions at all” and “anyone can run any code they desire on your server”.

I have thought about doing this with gitlab. honestly, I was just going to stand up a free instance on AWS and have my local repos sync to the public one.

no problems then.

No OpenID is configured against your OpenID server

I would strongly recommend against publicly exposing it. It will get hammered by bots continuously.

Instead, I would move public repos to Codeberg