{
 "slug": "gitea",
 "name": "Gitea",
 "tagline": "Lightweight self-hosted Git service with issues, pull requests and CI/CD",
 "category": "developer-platform",
 "use_cases": [
  "git-hosting",
  "code-review",
  "ci-cd"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Gitea Limited",
  "url": "https://gitea.com",
  "license": "MIT",
  "license_url": "https://github.com/go-gitea/gitea/blob/main/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443,
   2222
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "28.2.0",
   "last_build": "2026-10-25",
   "entity_id": "prod-su4pxu2o6o43c",
   "ami_alias": "/aws/service/marketplace/prod-su4pxu2o6o43c/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-sxbeaogngoble",
   "recommended_instance_type": "t3.small",
   "price_usd_per_hour": 0.03,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "1.27.3",
   "last_build": "2026-09-09",
   "offer_id": "gitea",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:gitea:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.gitea?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/gitea/",
  "json": "https://lynxroute.com/products/gitea/product.json"
 },
 "release_notes": [
  {
   "version": "28.2.0",
   "title": "Gitea 28.2.0",
   "notes": "* Gitea 28.2.0 on Ubuntu 24.04 LTS - major update from 1.27.3. Upstream dropped the historical \"1.\" prefix, so 28.x is the direct successor of 1.27. MIT unchanged\n* New: audit logging, bot accounts, deploy tokens, admin user impersonation, project and Actions run-management APIs, a block-on-pending-code-owner-reviews branch protection rule and an Actions build queue view\n* Security: Git network operations (migrations, mirrors) now pass through an internal egress proxy, invalid and duplicate Git objects are rejected on push, presented SSH keys are identified by fingerprint, and repository-scoped authorization is enforced for team access, deletion and package unlinking\n* Live UI notifications now use a WebSocket instead of server-sent events; the bundled Nginx forwards the upgrade headers\n* Completed Actions runs are deleted after 400 days by default (set [actions] RUN_RETENTION_DAYS = 0 to keep them)\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-25"
   }
  },
  {
   "version": "1.27.3",
   "title": "Gitea 1.27.3",
   "notes": "* Gitea 1.27.3 on Ubuntu 24.04 LTS - patch update from 1.27.2. MIT unchanged\n* Security: package registry access is now restricted correctly by token scope and by restricted or limited account status, attachments are bound to their owning repository, cross-repository issue references are checked against the same repository, and Actions artifact signatures are verified before use\n* Security: limited users are hidden from restricted viewers, repositories of hidden owners are hidden, fork pull-request trust boundaries are enforced, git hook permissions are restricted, and the repository-creation and compare endpoints check token authorization\n* Adds permalinks to pull request reviews\n* Fixes the pull-request merged state drifting from git, OpenPGP signature verification using an SSH instance key, co-author trailers that are not RFC 5322 addresses, and Actions matrix job grouping\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-06",
    "azure": "2026-09-09"
   }
  },
  {
   "version": "1.27.2",
   "title": "Gitea v1.27.2",
   "notes": "* Log rotation no longer restarts Gitea. The previous logrotate config sent SIGHUP, which is Gitea's graceful-restart signal: it re-execs into a new process that is not the unit's MainPID, so systemd saw the main process exit and restarted the service every night, dropping in-flight Git operations and SSH sessions. Rotation now uses `copytruncate` and signals nothing. Gitea 1.27.2 itself is unchanged.\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base.\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-24",
    "azure": "2026-08-26"
   }
  },
  {
   "version": "1.27.2",
   "title": "Gitea 1.27.2",
   "notes": "* Gitea 1.27.2 - lightweight self-hosted Git service (patch update from 1.27.0). Security fixes to collaborator access-mode handling and HTTP signature verification, external renderer and markup rendering hardening, per-request WebAuthn user verification, and resolution of pull_request_target reusable workflows at the base commit. Automatic schema migration on start\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-24",
    "azure": "2026-08-26"
   }
  },
  {
   "version": "1.27.0",
   "title": "Gitea 1.27.0",
   "notes": "* Gitea 1.27.0 - lightweight self-hosted Git service (minor update from 1.26.4); ships 40+ security fixes, a per-request CSP script nonce, and nosniff response headers on by default. Automatic schema migration on start\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-07-20",
    "azure": "2026-07-20"
   }
  },
  {
   "version": "1.26.4",
   "title": "Gitea 1.26.4 - June 2026",
   "notes": "* Gitea 1.26.4 on Ubuntu 24.04 LTS - lightweight self-hosted Git service (patch update from 1.26.2)\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-06-23",
    "azure": "2026-07-11"
   }
  },
  {
   "version": "1.26.2",
   "title": "Gitea 1.26.2 - May 2026",
   "notes": "* Gitea 1.26.2 on Ubuntu 24.04 LTS\n* Security release - OAuth token bound to original client request,\n  PKCE validation strengthened, refresh token replay protection,\n  token scope enforced on raw/media/attachment downloads, wiki git\n  writes and LFS token access checked at request time, permission\n  read fix, Mermaid dependency security update, AWS creds encrypted\n* Bug fixes (actions, API, packages, pull requests)\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-05-22",
    "azure": "2026-06-04"
   }
  },
  {
   "version": "1.26.1",
   "title": "Gitea 1.26.1 - April 2026",
   "notes": "* Updated to Gitea 1.26.1\n* Bug fixes and stability improvements\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-04-29",
    "azure": "2026-05-12"
   }
  }
 ],
 "release_history": [
  {
   "version": "28.2.0",
   "aws": "2026-10-25"
  },
  {
   "version": "1.27.3",
   "aws": "2026-09-06",
   "azure": "2026-09-09"
  },
  {
   "version": "1.27.2",
   "aws": "2026-08-24",
   "azure": "2026-08-26"
  },
  {
   "version": "1.27.0",
   "aws": "2026-07-20",
   "azure": "2026-07-20"
  },
  {
   "version": "1.26.4",
   "aws": "2026-06-23",
   "azure": "2026-07-11"
  },
  {
   "version": "1.26.2",
   "aws": "2026-05-22",
   "azure": "2026-06-04"
  },
  {
   "version": "1.26.1",
   "aws": "2026-04-29",
   "azure": "2026-05-12"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-su4pxu2o6o43c/latest \\\n  --instance-type t3.small --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer gitea --plan payg-gen2\naz vm create -g my-rg -n gitea --size Standard_D2s_v3 \\\n  --image lynxroute:gitea:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Gitea is a lightweight self-hosted Git service - a single statically linked Go binary that provides code hosting, pull requests, issue tracking, project boards, releases, and a built-in container registry. Gitea Actions runs Docker-based CI/CD pipelines compatible with the GitHub Actions workflow syntax. Operators get team and organisation management, fine-grained branch protection, OAuth/OIDC SSO, webhook integrations, and a REST + Swagger API. Persists code, issues, users and metadata in PostgreSQL with Git objects on the local filesystem. The fastest path to a fully self-hosted GitHub or GitLab alternative for teams that want code, issues and CI in one process. MIT license - no per-seat fees, no vendor lock-in.",
  "image_adds": "Security hardening:\n* Admin account with unique password (EC2 Instance ID) at first boot\n* Four internal secrets generated per instance at first boot\n* Nginx reverse proxy with TLS\n* UFW firewall - ports 22, 80, 443, 2222\n* fail2ban, AppArmor\n* PostgreSQL 16 local, listening on 127.0.0.1 only\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}