I am experimenting with using forgejo instead of GitHub for my personal projects. So far I like it, however I would like to make it available to the outside world at some point.
I was wondering what kind of traps I should avoid. The following things come to mind so far:
- Forgejo Actions seem like a massive potential security risk, however I do not intend to enable sign up for other
- OpenID appears to be a thing for forgejo, I do not know how it works and it seems like it would allow access to my instance even with registering disabled
- I would put the instance behind a nginx as reverse proxy, but how do you keep bot traffic to a minimum? Anubis?
I feel like there are a ton of things I have not thought of, which is why I am holding off on making anything available without a VPN so far.
I run it in a rootless Podman container using Quadlets. Instead of opening the server’s ssh port, I only port-forward the container’s ssh port (e.g. 22 -> 2222). I have sign-ups enabled, since I want people to be able to contribute (or just create issues). But I have configured the server so that nobody can create a repository. They can still fork my repos and send a pull request.
I have yet to experiment with Actions. I assume the safest option would be to only enable it for my own commits, but I am not sure.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters Git Popular version control system, primarily for code HTTP Hypertext Transfer Protocol, the Web IP Internet Protocol VPS Virtual Private Server (opposed to shared hosting) nginx Popular HTTP server
4 acronyms in this thread; the most compressed thread commented on today has 5 acronyms.
[Thread #195 for this comm, first seen 28th Mar 2026, 14:10] [FAQ] [Full list] [Contact] [Source code]
I would strongly recommend against publicly exposing it. It will get hammered by bots continuously.
Instead, I would move public repos to Codeberg
- oauth, and control sign ups via there. Don’t let people sign up via forgejo itself.
- anubis, yeah. Or similar.
- forgejo actions is an optional component… and forgejo users can bring their own actions server. Of course, it’s a risk to them since the server owner could execute code in actions. But yeah.
I definitely want to use forgejo actions, but I am mainly worried about random people being able to execute any code on them. Preferably only approved users can do that.
The way forgejo actions works, is that it is not a universal thing for every repo. Each repo, can have it’s own forgejo actions instance connected to it, running stuff.
The big benefit of that, is that you can make users bring their own actions servers, and not bother to deploy your own.
Yes, Check Anubis, scraper bots follow every link they find and especially git forges basically have infinite links (every single commit and comparison between every single commit and every other).
I haven’t thought it through but there may be some implications on opening port 22 for git via ssh.
Someone posted about git/scrapers here, pretty good read: https://vulpinecitrus.info/blog/guarding-git-forge-ai-scrapers/?ref=selfh.st
Lots of good answers already. Just want to add.
Block IP from every country that doesn’t have your users in it. That will go a long way.
