overview for gurapoku

Is it safe to open a forgejo git ssh port in my router? in c/[email protected]

[–] [email protected] 1 points 5 months ago* (last edited 5 months ago) (3 children)

Yes, hosting the site seems much safer (at least in theory) since I am proxying it through cloudflare and I am planning on putting ngynx too on top of that this afternoon

(And signup is disabled, so hopefully only trusted users can access it)

Is it safe to open a forgejo git ssh port in my router? in c/[email protected]

[–] [email protected] 2 points 5 months ago (2 children)

A good suggestion, but it would still be hasslesome to setup. Plus, my friend would have to connect to the vpn whenever he wants to push/pull the repo

Is it safe to open a forgejo git ssh port in my router? in c/[email protected]

[–] [email protected] 1 points 5 months ago (5 children)

Yes, or else I wouldn't have access to the web interface haha

Is it safe to open a forgejo git ssh port in my router? in c/[email protected]

[–] [email protected] 1 points 5 months ago

I'd rather not say which router I have since it would reveal quite a bit of information about me. However, I do know that the connections that my router allows are tcp and udp

Is it safe to open a forgejo git ssh port in my router? in c/[email protected]

[–] [email protected] 2 points 5 months ago

That's also a possibility, yes. Probably what I should do, taking the rest of the answers into account

Is it safe to open a forgejo git ssh port in my router? in c/[email protected]

[–] [email protected] 1 points 5 months ago (2 children)

I see, only allowing established traffic to connect sounds like something that could work. But I don't know how I can do this, do you have some pointers :)?

Blocking outgoing traffic and having to whitelist forgejo seems a bit extreme though

Is it safe to open a forgejo git ssh port in my router? in c/[email protected]

[–] [email protected] 4 points 5 months ago* (last edited 5 months ago)

The reason why I am asking this question is because I think that the ssh port I am opening only has access to my repos (which means that even if I somehow get hacked the damage is minimal) and it doesn't accept any keys aside from mine and my friend's, which we set up through the web interface :).

I have wireguard setup and I'd also thought about sharing a tunnel with my friend, but it seemed much more hasslesome than simply opening the port, not to mention the fact that if anyone wanted to join too I'd have to do that again.

It is exactly because I am afraid of getting fucked that I am asking this and being careful. For now, my idea is to only open the port when someone is about to use it, since I am not absolutely sure that it won't somehow accept a request from a person with less than noble intentions. (either that, either simply use tokens)

Reverse proxying was also my intention at first, but I just couldn't get it to work with cloudflare for some reason!

Thanks for the insight!

Is it safe to open a forgejo git ssh port in my router? in c/[email protected]

[–] [email protected] 2 points 5 months ago* (last edited 5 months ago) (3 children)

I am still very much a noob to self-hosting, but I am not the one managing this ssh port, forgero is. Is there not any difference between the two? I think you can only access the forgejo ssh if you have a matching private key for one of the user's public keys...

(And although it surprised me too, I couldn't find information about the safety of specifically this online)

31

Is it safe to open a forgejo git ssh port in my router? (lemmy.world)

submitted 5 months ago* (last edited 5 months ago) by [email protected] to c/[email protected]

29 comments fedilink

Hello all! Yesterday I started hosting forgejo, and in order to clone repos outside my home network through ssh://, I seem to need to open a port for it in my router. Is that safe to do? I can't use a vpn because I am sharing this with a friend. Here's a sample docker compose file:

version: "3"

networks:
  forgejo:
    external: false

services:
  server:
    image: codeberg.org/forgejo/forgejo:7
    container_name: forgejo
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - FORGEJO__database__DB_TYPE=postgres
      - FORGEJO__database__HOST=db:5432
      - FORGEJO__database__NAME=forgejo
      - FORGEJO__database__USER=forgejo
      - FORGEJO__database__PASSWD=forgejo
    restart: always
    networks:
      - forgejo
    volumes:
      - ./forgejo:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "3000:3000"
      - "222:22" # <- port 222 is the one I'd open, in this case
    depends_on:
      - db

  db:
    image: postgres:14
    restart: always
    environment:
      - POSTGRES_USER=forgejo
      - POSTGRES_PASSWORD=forgejo
      - POSTGRES_DB=forgejo
    networks:
      - forgejo
    volumes:
      - ./postgres:/var/lib/postgresql/data

And to clone I'd do

git clone ssh://git@<my router ip>:<the port I opened, in this case 222>/path/to/repo

Is that safe?

EDIT: Thank you for your answers. I have come to the conclusion that, regardless of whether it is safe, it doesn't make sense to increase the attack surface when I can just use https and tokens, so that's what I am going to do.