Step 1 – Verify Gitea Works

Your server’s IP address and root password are shown in the Server Information section on the Overview tab of your server in the client portal. The application settings you entered when ordering, passwords included, are shown in the Gitea Credentials card on the same tab. Gitea is available immediately after the server is created. Open https://your.server.ip in a browser to verify it works.

Gitea login:

• Username: admin
• Password: the Admin Password you entered during the order

On first boot the server gets a Let’s Encrypt certificate for its IP address, so the page opens without a browser warning. If your server is not reachable from the internet on port 80, the certificate cannot be issued and the browser shows a warning for a self-signed certificate – click Advanced > Proceed (or Accept the Risk in Firefox). You can install a proper Let’s Encrypt certificate later (see Step 4).

If you placed the server behind a VyOS router on a private network, the server has only a private address, so it does not get the IP certificate, and Gitea is set up for that private address. You can open Gitea over http:// on the private address through a VPN on the router (WireGuard or OpenVPN, on the router’s Configuration tab). To make Gitea reachable from the internet, forward ports 80 and 443 to the server on the router’s Configuration tab (Port forwarding), point your domain to the router’s public address and connect the domain (Steps 3-4): until then, Gitea’s links point to the private address. Forward port 22 as well to push and pull over SSH from the internet.

Firewall. If you turn on the Firewall for this server in the client portal, allow incoming TCP port 80 in its rules, along with 443 (HTTPS) and 22 for Git over SSH. Certificates renew over port 80 – the IP certificate every few days – and without that rule the certificate expires and the browser starts showing a warning.

Step 2 – Create Your First Repository

Click the + button in the top right corner and select New Repository. Fill in the repository name and click Create Repository.

Clone your repository using HTTPS or SSH:

# HTTPS
git clone https://your.server.ip/admin/my-repo.git

# SSH (add your public key in Settings > SSH/GPG Keys first)
git clone git@your.server.ip:admin/my-repo.git

Git SSH uses port 22 (the standard SSH port). Gitea automatically manages SSH keys – when you add a public key in the web interface, it becomes available for Git operations immediately.

Step 3 – Set Up a Custom Domain

To use Gitea on your own domain instead of the server IP:

1. Create a DNS A record pointing your domain to the server IP:

   Type	Name	Value
   A	git	your.server.ip

2. SSH into your server and edit the Gitea config:

   nano /etc/gitea/app.ini

   Update these lines in the [server] section:

   DOMAIN     = git.yourdomain.com
   SSH_DOMAIN = git.yourdomain.com
   ROOT_URL   = https://git.yourdomain.com/

3. Update Nginx and restart services:

   sed -i "s/server_name .*/server_name git.yourdomain.com;/g" /etc/nginx/sites-available/gitea
   systemctl restart gitea
   systemctl reload nginx

DNS changes usually take a few minutes, but can take up to 24 hours. Check at dnschecker.org.

Step 4 – Enable Let’s Encrypt SSL

Once your domain points to the server, issue a Let’s Encrypt certificate for the domain itself. Connect via SSH and run:

/opt/setup/get-ssl.sh git.yourdomain.com

The script verifies DNS, obtains a certificate, configures Nginx for HTTPS, and updates the Gitea config automatically. The certificate renews automatically.

Make sure your domain’s A record has propagated before running the script. This step is optional – until you add a domain, Gitea is served over HTTPS on its IP address.

Step 5 – CI/CD with Gitea Actions

Your Gitea instance comes with a built-in CI/CD runner (Gitea Actions). It is compatible with GitHub Actions workflow syntax. To use it, create a workflow file in your repository:

.gitea/workflows/build.yaml

Example workflow:

name: Build
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: echo "Hello from Gitea Actions!"

The runner executes jobs directly on the host (no Docker required). Check runner status:

systemctl status act_runner

Fail2Ban – Brute-Force Protection

Your server comes with Fail2Ban pre-configured to protect both SSH and the Gitea web interface from brute-force attacks.

Useful commands:

# Check banned IPs
fail2ban-client status sshd
fail2ban-client status gitea

# Unban an IP
fail2ban-client set sshd unbanip 1.2.3.4
fail2ban-client set gitea unbanip 1.2.3.4

If you accidentally lock yourself out, open the Console on your server’s Overview tab in the client portal and unban your IP.

Updates

Gitea is installed as a standalone binary and does not update automatically. To update manually, download the new version and replace the binary:

# Download new version (replace X.Y.Z with the desired version)
wget -O /tmp/gitea https://dl.gitea.com/gitea/X.Y.Z/gitea-X.Y.Z-linux-amd64
chmod +x /tmp/gitea

# Replace binary and restart
systemctl stop gitea
cp /tmp/gitea /usr/local/bin/gitea
systemctl start gitea

OS updates can be applied via SSH:

apt update && apt upgrade -y

Server Credentials

Gitea admin credentials are stored in /root/.gitea_credentials. You can also see them when you connect via SSH (displayed in the welcome message).

Service Management

# Service status and control
systemctl status gitea          # check Gitea status
systemctl restart gitea         # restart Gitea
systemctl status nginx          # check Nginx (reverse proxy)
systemctl reload nginx          # reload Nginx after config change
systemctl status act_runner     # check CI/CD runner

# Gitea admin CLI
sudo -u git gitea admin user list --config /etc/gitea/app.ini
sudo -u git gitea admin user change-password --username admin --password "newpass" --config /etc/gitea/app.ini

# Database backup (SQLite)
cp /var/lib/gitea/data/gitea.db /root/gitea-backup-$(date +%Y%m%d).db

# Logs
tail -f /var/lib/gitea/log/gitea.log     # Gitea application log
journalctl -u gitea -f                    # systemd journal
tail -f /var/log/nginx/error.log          # Nginx errors

Software Included

• Gitea Documentation: docs.gitea.com
• Gitea Actions Guide: docs.gitea.com/usage/actions/overview
• Gitea on GitHub: github.com/go-gitea/gitea