I want to self host all my git repos so i dont have to deal with bullshit from providers that do shit like train ai and can at any point go down and my shit goes with it, since im behind NAT and im a cheapass i dont want to spend money on a vps so im thinking of hosting it using the onion protocol, how much of a pain in the ass would that be (not just setting up the service since thats easy but like getting it to clone on a new machine and not having to remember the onion link every time) and what would be the security implications?
the reason im considering a hidden service is to not have to pay for an ip address since my isp charges for it, im behind CGNAT so therefore cant simply port forward
im not trying to host anything illegal just want to not rely on microsoft (since i currently use github to host all my repos) or some fuckass company with a smaller github clone that could get closed at any moment and all my shit is gone
im not trying to host anything illegal just want to not rely on microsoft (since i currently use github to host all my repos) or some fuckass company with a smaller github clone that could get closed at any moment and all my shit is gone
Totally doable, and not as painful as it sounds actually IMO. Tor hidden services punch through NAT, so you can host a bare repo over SSH without a VPS, just run tor, create a v3 service that maps 22 to your local sshd, make a git user locked to git-shell, disable password auth, and keep the repo on an encrypted volume.
Usability is fine if you set an SSH alias so you never type the onion, for example in ~/.ssh/config: Host mygit, HostName abcdef...onion, User git, Port 22, ProxyCommand nc -x 127.0.0.1:9050 -X 5 %h %p, then you can git clone mygit:repo.git on any machine with Tor.
Security-wise, prefer SSH keys, restrict the git user to repos it needs, don’t expose git://, keep the box updated through Tor, and avoid running a big web UI if you don’t need it, a simple cgit behind Onion is lighter than Gitea. Biggest gotchas are speed and availability, initial clones can be slow and if that one box dies you’re out, so keep off-site backups or a second onion mirror with git pull --mirror and consider OnionBalance if you want redundancy.
Also watch for OPSEC leaks, don’t browse or do clearnet stuff from the same machine at the same time, keep time sync stable, and rotate keys if a laptop goes missing. Once the alias is set, new machines are easy, drop your pubkey in authorized_keys on the host and you’re cloning with mygit like it’s a normal remote.
Usability is fine if you set an SSH alias so you never type the onion, for example in ~/.ssh/config: Host mygit, HostName abcdef...onion, User git, Port 22, ProxyCommand nc -x 127.0.0.1:9050 -X 5 %h %p, then you can git clone mygit:repo.git on any machine with Tor.
Security-wise, prefer SSH keys, restrict the git user to repos it needs, don’t expose git://, keep the box updated through Tor, and avoid running a big web UI if you don’t need it, a simple cgit behind Onion is lighter than Gitea. Biggest gotchas are speed and availability, initial clones can be slow and if that one box dies you’re out, so keep off-site backups or a second onion mirror with git pull --mirror and consider OnionBalance if you want redundancy.
Also watch for OPSEC leaks, don’t browse or do clearnet stuff from the same machine at the same time, keep time sync stable, and rotate keys if a laptop goes missing. Once the alias is set, new machines are easy, drop your pubkey in authorized_keys on the host and you’re cloning with mygit like it’s a normal remote.
how can ssh and git resolve onion addresses, and would it be possible to have a real domain point to the onion service in some way (it would be much more convenient to just git clone foo.tld/repo and ssh foo.tld)?
also about opsec, why should i not browser or do clearnet stuff from that machine, what harm could that cause? also is storing the repo on an encrypted volume necessary if im only hosting legal shit (for now atleast :3)
also about opsec, why should i not browser or do clearnet stuff from that machine, what harm could that cause? also is storing the repo on an encrypted volume necessary if im only hosting legal shit (for now atleast :3)
if they arent anything illegal why not just store them on your own hardware
im behind CGNAT and im a cheapass so dont want to pay for a static ip or a vps