Catalog / Developer platforms

Gitea

Lightweight self-hosted Git service with issues, pull requests and CI/CD

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace28.2.0↗ Azure Marketplace1.27.3↗

Availability and pricing

Cloud	Version	Software price	Last build
AWS Marketplace EC2 AMI · all commercial regions	28.2.0	$0.03/hr Recommended instance: t3.small · 5-day free trial	2026-10-25	Listing ↗
Azure Marketplace VM image · plan payg-gen2 · Gen2	1.27.3	$0.028/vCPU/hr Recommended VM: Standard_D2s_v3	2026-09-09	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	MIT
Upstream	Gitea Limited
Machine-readable	product.json · catalog.json

What is Gitea

Gitea is a lightweight self-hosted Git service - a single statically linked Go binary that provides code hosting, pull requests, issue tracking, project boards, releases, and a built-in container registry. Gitea Actions runs Docker-based CI/CD pipelines compatible with the GitHub Actions workflow syntax. Operators get team and organisation management, fine-grained branch protection, OAuth/OIDC SSO, webhook integrations, and a REST + Swagger API. Persists code, issues, users and metadata in PostgreSQL with Git objects on the local filesystem. The fastest path to a fully self-hosted GitHub or GitLab alternative for teams that want code, issues and CI in one process. MIT license - no per-seat fees, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

Admin account with unique password (EC2 Instance ID) at first boot
Four internal secrets generated per instance at first boot
Nginx reverse proxy with TLS
UFW firewall - ports 22, 80, 443, 2222
fail2ban, AppArmor
PostgreSQL 16 local, listening on 127.0.0.1 only

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/gitea-credentials.txt.

AWS CLIAzure CLI

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-su4pxu2o6o43c/latest \
  --instance-type t3.small --key-name my-key --security-group-ids sg-xxxxxxxx

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer gitea --plan payg-gen2
az vm create -g my-rg -n gitea --size Standard_D2s_v3 \
  --image lynxroute:gitea:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Gitea 28.2.0

AWS · 2026-10-25

Gitea 28.2.0 on Ubuntu 24.04 LTS - major update from 1.27.3. Upstream dropped the historical "1." prefix, so 28.x is the direct successor of 1.27. MIT unchanged
New: audit logging, bot accounts, deploy tokens, admin user impersonation, project and Actions run-management APIs, a block-on-pending-code-owner-reviews branch protection rule and an Actions build queue view
Security: Git network operations (migrations, mirrors) now pass through an internal egress proxy, invalid and duplicate Git objects are rejected on push, presented SSH keys are identified by fingerprint, and repository-scoped authorization is enforced for team access, deletion and package unlinking
Live UI notifications now use a WebSocket instead of server-sent events; the bundled Nginx forwards the upgrade headers
Completed Actions runs are deleted after 400 days by default (set [actions] RUN_RETENTION_DAYS = 0 to keep them)
Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base