Gitea: Self-Hosted Git Forge Replacing GitHub and GitLab Training Course

Source Code Sovereignty for Government

• Why cloud Git platforms may expose proprietary code and trade secrets, posing risks to government agencies.
• Gitea architecture and its comparison with GitHub, GitLab, and Forgejo in the context of secure software development for government.
• Licensing, terms-of-service, and data export considerations specific to government operations and compliance requirements.

Installation and Configuration for Government

• Deploying Gitea using Docker Compose with PostgreSQL and Redis, suitable for government IT environments.
• Installing Gitea as a binary on Linux systems with systemd service configuration to meet government standards.
• Configuring reverse proxy, TLS, and SSH ports to ensure secure communication channels for government networks.
• Using the initial setup wizard to configure the database, create an admin account, and tune app.ini settings for optimal performance in government operations.

Repository Management for Government

• Creating organizations, teams, and repositories to support structured collaboration within government agencies.
• Implementing branch protection, required reviews, and signed commits to ensure code integrity and compliance in government projects.
• Utilizing issue tracking, labels, milestones, and Kanban boards for effective project management in government initiatives.
• Hosting wikis and release artifacts to provide comprehensive documentation and resources for government software development.

CI/CD with Gitea Actions for Government

• Enabling Gitea Actions and registering act runners to support continuous integration and deployment processes in government IT projects.
• Writing workflow YAML files for build, test, and deploy operations tailored to government requirements.
• Ensuring self-hosted runner security and container isolation to protect sensitive government data.
• Implementing artifact caching and matrix builds to optimize CI/CD pipelines in government environments.

Migration from Cloud Forges for Government

• Using repository mirroring and import features to transition from GitHub/GitLab, ensuring continuity of government projects.
• Migrating issues, pull requests, and release notes while maintaining the integrity of project documentation in government repositories.
• Preserving commit signatures and GPG key trust during migration to ensure the authenticity and security of government code.

Authentication and Access Control for Government

• Integrating LDAP, Active Directory, and OpenID Connect to support secure user authentication in government systems.
• Implementing two-factor authentication and deploy token management to enhance security measures for government repositories.
• Managing repository visibility with public, internal, and private scopes to align with government data access policies.

Security and Compliance for Government

• Enforcing commit signing with GPG and SSH keys to ensure the integrity of code in government repositories.
• Implementing audit logging for repository access and admin changes to support accountability and compliance in government operations.
• Utilizing dependency scanning and vulnerability webhook alerts to identify and address security risks in government software projects.

Maintenance and Scaling for Government

• Developing backup strategies for Git data, issues, and attachments to ensure data resilience in government IT infrastructure.
• Optimizing database performance and offloading attachments to S3 to improve the efficiency of government repository management.
• Planning and executing Gitea upgrades while managing breaking changes to maintain continuity in government operations.