Configuration and HTTPS

Choose how the console reaches your browser, and keep service credentials private.

Automatic HTTPS

Point your domain at the server and make ports 80 and 443 available. The web process serves HTTPS on 443 and redirects HTTP GET/HEAD requests on 80 to the configured HTTPS origin. Certificate validation uses TLS-ALPN-01 on port 443.

The installer defaults to ACME staging. Pass --acme-production deliberately for browser-trusted certificates; this accepts the certificate authority's terms. The private certificate cache lives under /var/lib/gitsvc-web/acme and must survive restarts and upgrades. Certificate failure never falls back to HTTP sign-in.

Existing reverse proxy

Use --mode proxy --http-port 8080 with both installer plan and apply commands. Omit --acme-production. Terminate HTTPS at your proxy, preserve the original Host, and forward to 127.0.0.1:8080. Give the console its own hostname.

The public origin remains https://git.example.com. Forwarded headers cannot change it. The application requires an exact matching Host; mutations also need the configured Origin and CSRF token. A custom public HTTPS port is supported through manual public_origin configuration. Plain HTTP browser sign-in is only for explicit loopback development.

Email delivery

Configure the included config/mail.example.toml. Use required STARTTLS on 587 or verified implicit TLS on 465. Keep the installed mail file owned by the daemon identity, mode 0600; the public web process must not read it. Mail provider credentials are never entered in the browser console.

The service uses an existing SMTP relay. It does not create a provider account or depend on CP Hub email.

Git SSH

Fresh installations use a dedicated Git SSH listener on 2222 by default. --ssh-port selects another unused port. The installer preserves administrative SSH. Copy the console's complete clone URL, including its port. Shared Git/administrative SSH on 22 requires the reviewed manual runbook; the fresh installer does not configure it.

Existing installations

Do not run the fresh-host installer on an existing service. Upgrade using the browser operator runbook, preserving user IDs, repositories, keys, memberships, SSH listeners and client remotes.

Browser support uses schema 5 and a separate gitweb identity, restricted Unix socket, systemd sandbox and daemon-owned SMTP configuration. Existing identities need explicit email enrollment before they can sign in. Older binaries refuse schema 5; rollback requires a compatible binary. Do not remove migration rows to downgrade.

Before opening access, verify distinct OS identities, the actual volume/quota boundary, private socket isolation, real SMTP delivery and public HTTPS. A passing local test suite does not establish those host boundaries.