DCA Hardened Git Server for Gitea — Support & Quick Start

At a glance

Status	Live on Oracle Cloud Marketplace
Version	28.0.0
Platform	Oracle Linux 9
Ports open in the host firewall	SSH (22/tcp), 3000/tcp
Category	Developer tools
Upstream licence	MIT
Pricing	Pay-as-you-go software fee per OCPU-hour, billed by Oracle on your OCI invoice — see the listing's Pricing tab

Quick start

This is the listing's usage information, verbatim. Every command in it is run by our QA on a freshly launched instance before an image version can publish, so the text and the tested procedure cannot drift apart.

After launch:

1. Connect over SSH as the opc user with the key you supplied at launch:

   ssh opc@PUBLIC_IP

2. Gitea runs as a systemd service on 127.0.0.1:3000. On first boot it creates the admin account and instance-unique secrets; check status:

   sudo systemctl status gitea

3. Read the generated administrator credentials (root only):

   sudo cat /root/.gitea_default_credentials

   You will be required to change the password at first login.

4. Reach the web UI safely by tunnelling over SSH:

   ssh -L 3000:127.0.0.1:3000 opc@PUBLIC_IP
   then open http://localhost:3000 and sign in as dcaadmin.

5. To expose Gitea beyond the instance (behind a TLS reverse proxy is recommended), rebind it to all interfaces and restart:

   sudo sed -i 's/^HTTP_ADDR = 127.0.0.1$/HTTP_ADDR = 0.0.0.0/' /etc/gitea/app.ini && sudo systemctl restart gitea

   Also set ROOT_URL under [server] in /etc/gitea/app.ini to the URL your users reach, so clone URLs are correct.

   Port 3000/tcp is already permitted in the host firewall. Restrict TCP 3000 in your VCN security list to the client CIDR; never expose an unproxied Gitea to the internet.

6. Clone and push over HTTP(S); Git over SSH is disabled (DISABLE_SSH = true in /etc/gitea/app.ini). Data (repositories + SQLite DB) lives in /var/lib/gitea; configuration in /etc/gitea/app.ini. Recommended sizing: at least 2 OCPU (4 vCPU) and 16 GB memory, scaling with repository count and CI usage.

The image is CVE-patched at build time. Apply ongoing updates with:

sudo dnf -y update

What the image provides

• Gitea 28.0.0, installed from the project's official signed binary with its SHA-256 checksum verified at build time, running as a dedicated unprivileged service.
• Fully self-contained: the built-in SQLite backend means no external database to provision. Launch one instance and you have a working Git server.
• Instance-unique security on first boot. A random administrator password and unique SECRET_KEY and INTERNAL_TOKEN are generated the first time the instance starts; nothing secret is baked into the image, and open registration is disabled by default.
• Loopback-bound by default; the web listener answers only on 127.0.0.1 until you place it behind TLS and open the port deliberately.
• Security hardening aligned to the Oracle Cloud Marketplace image standards: SELinux enforcing, host firewall default-deny with only SSH and the Gitea port permitted, no account with a usable OS password, no stray keys, and the image fully patched at build time.

Fixed issues

Found by our customer-path QA, fixed in a new image version. Launch the current version for new deployments.

• Fixed in 28.0.0 (2026-10-07): On version 1.26.4 the Gitea service never started. At startup Gitea tried to write a generated JWT secret into /etc/gitea/app.ini, which the hardened service sandbox keeps read-only, so it exited (sudo journalctl -u gitea showed "save oauth2.JWT_SECRET failed") and first boot could not create the administrator. Version 28.0.0 generates every secret at first boot, outside the service sandbox, and our customer-path QA signs in with the generated administrator.
  On an instance launched from 1.26.4: no repositories can exist on a 1.26.4 instance, because the service never ran. Launch a new instance from version 28.0.0, or email support@dcassociatesgroup.com for help.

Still stuck?

Email support@dcassociatesgroup.com (response within 1 business day) or use the contact form. Include the listing name, your OCI region, the instance OCID and the output of sudo journalctl -u <service> -n 100 for the unit named in the quick start.

Gitea is a trademark of Gitea Limited. This image is an independent hardened distribution and is not affiliated with, endorsed by, or sponsored by Gitea Limited.