Gitblit 1.10.0 on AWS User Guide

Overview

This guide covers launching and using the Gitblit 1.10.0 on Ubuntu 24.04 AMI from cloudimg on Amazon EC2. It is one version of the cloudimg Hardened Apache Subversion (SVN) & CI/CD Tools listing on AWS Marketplace; you pick it as the software version when you subscribe and launch.

Gitblit is an open source, pure Java Git server. It hosts your repositories, serves git clone, fetch and push over HTTPS (and over SSH, when you open it), and has a web interface for browsing repositories, commits, branches, files, tickets and users. Accounts, teams and per-repository permissions live in Gitblit itself; there is no external database.

The cloudimg image adds:

• No default account. Upstream's admin/admin account never exists on this image. First boot creates the admin account with a 24 character password generated on your instance, and writes it to /root/gitblit-credentials.txt (root only). Gitblit refuses to start without that account file, and refuses one that holds a plain text password.
• Nothing shared between instances. The image ships no password, certificate or SSH host key. First boot creates the administrator password, the HTTPS certificate and Gitblit's three SSH host keys (RSA, ECDSA and Ed25519) on your instance.
• Every request needs a credential. Anonymous visitors get nothing: every page, every git clone and push, the RPC API, the RSS feeds, raw file and zip downloads all need a user name and password. nginx answers a request without one with 401 before it reaches Gitblit, and new repositories default to Restrict View, Clone & Push. There is no self-registration: only an administrator adds accounts.
• A rate-limited login. Requests that carry a credential are limited per client address (5 a second, with a burst of 150), so a password cannot be guessed at speed.
• Gitblit on loopback behind nginx. Gitblit's own HTTP listener is 127.0.0.1:8080; nginx serves it on port 443 with a certificate generated on your instance, and port 80 redirects. Gitblit's own HTTPS port, its shutdown port, the unauthenticated git daemon (9418), fanout and federation are off.
• SSH git access on loopback until you open it. Gitblit's SSH server accepts public keys only and listens on 127.0.0.1:29418. Use it through an SSH tunnel, or open it to your network in three steps (Step 8).
• No server-side scripts. Gitblit can run Groovy push hooks and plugins; those run as the Gitblit service with its full access, so they are an administrator-only feature. The image ships none enabled: the hook and plugin folders are empty and root owned (Step 9).
• Sandboxed service, metadata blocked. Gitblit runs as the unprivileged gitblit account in a systemd sandbox that lets it talk to the loopback address only. Gitblit, nginx, first boot and the helper commands cannot reach the EC2 instance metadata service.
• Patched libraries. Nine bundled Java libraries (Apache MINA, FreeMarker, Bouncy Castle and Wicket) are raised to their patched releases from Maven Central, inside the same major and minor versions.
• Fully patched Ubuntu 24.04 LTS at build time, with unattended security upgrades switched on.

What is on the image: Gitblit 1.10.0 (Apache-2.0), OpenJDK 17, nginx and git from Ubuntu 24.04, Ubuntu 24.04 LTS, cloud-init and the AWS Systems Manager agent.

Default user: ubuntu · Architecture: x86_64 · Recommended instance type: m5.large

Trademark notice. Gitblit is an open source project (github.com/gitblit-org/gitblit). Git is a trademark of the Software Freedom Conservancy. cloudimg is not affiliated with, endorsed by or sponsored by the Gitblit project or the Software Freedom Conservancy; the names are used only to identify the open source software in this image.

Prerequisites

• An AWS account subscribed to the listing, an EC2 key pair and a VPC subnet.
• A security group that allows TCP 443 (the web interface and git over HTTPS) and TCP 80 (redirects to HTTPS) from the networks your users work from, and TCP 22 (SSH) from your own network only. Gitblit needs no other inbound port.

Step 1: Launch the instance

In the AWS Marketplace listing choose Continue to Subscribe, then Continue to Configuration, pick Gitblit 1.10.0 on Ubuntu 24.04 as the software version and your Region, then Launch through EC2. Choose m5.large, your key pair, a security group as above, and a subnet. Your repositories live on the root volume under /var/lib/gitblit; raise its size under Configure storage for large repositories.

With the AWS CLI (replace the values in angle brackets; this sets a 50 GiB root volume):

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=50,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=gitblit}]'

Step 2: Connect to your instance

Version	SSH user
Gitblit 1.10.0 on Ubuntu 24.04	ubuntu

ssh -i <your-key.pem> ubuntu@<public-ip>

Step 3: Check the services

First boot works out the instance's name, generates the certificate, the administrator password and Gitblit's SSH host keys, starts Gitblit, proves a round trip over HTTPS and only then opens the web server. It takes about a minute:

systemctl is-active gitblit nginx gitblit-set-host

active
active
active

gitblit-set-host runs on every boot before nginx: it keeps the served name, the certificate and nginx's host rules in step (Step 10).

Only SSH (22) and nginx (80, 443) listen on the network. Gitblit's web listener (8080) and its SSH server (29418) are on the loopback address only (Java shows them as the IPv4-mapped [::ffff:127.0.0.1]). The :53 entries are Ubuntu's local DNS resolver, :323 is the time service on the loopback address and :68 is the DHCP client:

sudo ss -lntup | awk 'NR>1 {print $1, $5}' | sort -u

tcp 0.0.0.0:22
tcp 0.0.0.0:443
tcp 0.0.0.0:80
tcp 127.0.0.53%lo:53
tcp 127.0.0.54:53
tcp [::]:22
tcp [::]:443
tcp [::]:80
tcp [::ffff:127.0.0.1]:29418
tcp [::ffff:127.0.0.1]:8080
udp 127.0.0.1:323
udp 127.0.0.53%lo:53
udp 127.0.0.54:53
udp 172.31.80.97%ens5:68
udp [::1]:323

Gitblit runs as the gitblit account on Ubuntu's OpenJDK 17. Its settings are in /etc/gitblit/gitblit.properties; the command line carries the listener ports, so that no other file can change them:

ps -o user:10=,args= -C java
java -version 2>&1 | head -1

gitblit    /usr/bin/java -XX:MaxRAMPercentage=40 -XX:+ExitOnOutOfMemoryError -XX:-UsePerfData -Djava.awt.headless=true --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED -cp /opt/gitblit/gitblit.jar:/opt/gitblit/ext/* com.gitblit.GitBlitServer --baseFolder /var/lib/gitblit --settings /etc/gitblit/gitblit.properties --httpPort 8080 --httpsPort 0 --gitPort 0 --sshPort 29418 --shutdownPort 0 --tempFolder /var/lib/gitblit/temp --repositoriesFolder /var/lib/gitblit/git --userService /var/lib/gitblit/users.conf
openjdk version "17.0.20.1" 2026-08-18

Gitblit may use up to 40% of the instance's memory for its Java heap, so a larger instance type gives it more room without any change.

If nginx is not running, first boot has not finished, or it failed, in which case the web server is never opened. Check systemctl status gitblit-firstboot and sudo tail -40 /var/log/cloudimg/gitblit-firstboot.log.

Step 4: Get your address and password

sudo cat /root/gitblit-credentials.txt

The file is readable by root only and holds the address, the administrator's user name and password and the certificate fingerprint:

# Gitblit - generated on first boot. Unique to this instance; keep it safe.
# Sign in at GITBLIT_URL as GITBLIT_USERNAME / GITBLIT_ADMIN_PASSWORD (the browser asks for them: HTTP Basic over TLS).
# Clone: git clone https://ec2-203-0-113-10.compute-1.amazonaws.com/r/<repository>.git   (git asks for the same user name and password)
# Compare GITBLIT_TLS_SHA256 with the certificate your browser shows (or install your own certificate: see the guide).
GITBLIT_URL=https://ec2-203-0-113-10.compute-1.amazonaws.com/
GITBLIT_USERNAME=admin
GITBLIT_ADMIN_PASSWORD=<GITBLIT_ADMIN_PASSWORD>
GITBLIT_TLS_SHA256=38:1D:8B:33:0B:BC:51:0C:65:24:84:46:AF:F4:07:35:50:6B:0C:F3:37:15:FC:B2:31:F0:42:14:CA:35:E5:2B

To see everything but the password:

sudo grep -E '^GITBLIT_(URL|USERNAME|TLS_SHA256)=' /root/gitblit-credentials.txt

GITBLIT_URL=https://ec2-203-0-113-10.compute-1.amazonaws.com/
GITBLIT_USERNAME=admin
GITBLIT_TLS_SHA256=38:1D:8B:33:0B:BC:51:0C:65:24:84:46:AF:F4:07:35:50:6B:0C:F3:37:15:FC:B2:31:F0:42:14:CA:35:E5:2B

You can confirm the whole path from the instance itself. The helper goes through nginx over HTTPS with the certificate pinned. It checks that 19 kinds of request are refused without a credential, that a wrong password and the well known defaults (admin/admin, admin/password, gitblit/gitblit) are refused, and that this instance's password is accepted by the web interface, the RPC API and git:

sudo /usr/local/sbin/gitblit-verify.sh

GITBLIT_ROUNDTRIP_OK (HTTPS: 19 routes refused without a credential, wrong/admin:admin/admin:password/gitblit:gitblit refused; the minted credential accepted by the web UI, RPC and git smart HTTP)

Change the password with gitblit-set-password. With no argument it generates a new 24 character password; with - it reads yours from standard input (at least 16 printable characters, no spaces, :, " or backslash). It never accepts the password as an argument, so it does not appear in the process list or your shell history. It updates /root/gitblit-credentials.txt, and Gitblit refuses the old password as soon as the command returns:

$ sudo gitblit-set-password
gitblit-set-password: the admin password was replaced (sudo cat /root/gitblit-credentials.txt)

To choose your own:

$ read -rs NEWPW && printf '%s\n' "$NEWPW" | sudo gitblit-set-password - ; unset NEWPW
gitblit-set-password: the admin password was replaced (sudo cat /root/gitblit-credentials.txt)

Other accounts change their own password in the web interface (their name, top right, then change password), or an administrator sets it under users.

Step 5: Sign in to the web interface

Open GITBLIT_URL in your browser. The certificate is self-signed until you install your own (Step 10), so the browser warns once; compare the fingerprint it shows with GITBLIT_TLS_SHA256. The browser then asks for a user name and password: admin and the password from Step 4. Gitblit uses HTTP Basic authentication over TLS for every page, so there is no separate sign-in form and no "remember me" cookie.

The dashboard lists the repositories you own and recent activity:

Step 6: Create a repository and push to it

In the web interface: open the menu under your user name (top right) and choose new repository. Give it a name (use / to group repositories into projects, for example team/service.git). Restrict View, Clone & Push is preselected, so only the accounts you name can see the repository. Tick Include a README if you want to clone it straight away:

From git: an administrator (or an account an administrator gave the can create right) can also create a repository by pushing to a new name. Clone URLs are https://<host>/r/<repository>.git; git asks for your user name and password. From your workstation:

git init hello && cd hello
echo "# hello" > README.md
git add README.md && git commit -m "First commit"
git push https://<host>/r/hello.git master

To trust the instance's self-signed certificate on your workstation, copy /etc/ssl/gitblit/gitblit.crt from the instance and use git -c http.sslCAInfo=gitblit.crt ..., or install a certificate from your own CA (Step 10). Never set http.sslVerify=false.

The same round trip on the instance itself. The password goes to git through a small GIT_ASKPASS script that reads it from the credentials file, so it is never typed, printed or put on a command line:

cd "$(mktemp -d)"
GB_URL=$(sudo sed -n 's/^GITBLIT_URL=//p' /root/gitblit-credentials.txt)
printf '#!/bin/sh\ncase "$1" in Username*) echo admin ;; *) sudo sed -n "s/^GITBLIT_ADMIN_PASSWORD=//p" /root/gitblit-credentials.txt ;; esac\n' > askpass.sh
chmod 700 askpass.sh
export GIT_ASKPASS="$PWD/askpass.sh"
git -c init.defaultBranch=master init -q hello && cd hello
echo "# hello" > README.md
git add README.md && git -c user.name=Demo -c user.email=demo@example.com commit -qm "First commit"
git -c http.sslCAInfo=/etc/ssl/gitblit/gitblit.crt push -q "${GB_URL}r/hello.git" master 2>&1 | grep -v '^remote:' || true
cd .. && git -c http.sslCAInfo=/etc/ssl/gitblit/gitblit.crt clone -q "${GB_URL}r/hello.git" hello-copy
cat hello-copy/README.md
git -C hello-copy log --oneline

# hello
743c6f4 First commit

The repository now has its summary page, with the clone URL for your account, the branches and the activity:

Browse files under tree, history under commits, and each commit with its diff:

Step 7: Users, teams and permissions

Administrators manage accounts under users and teams, in the menu under their user name (top right). Choose new user, set a user name and a password of at least 12 characters, then grant repository permissions per repository or through a team: V view, R clone, RW push, RWC push and create branches and tags, RWD also delete them, RW+ also rewrite history (force push):

Accounts are stored with PBKDF2 password hashes in /var/lib/gitblit/users.conf, readable by the gitblit account only. There is no sign-up page and no external directory: every account is one an administrator created. Keep the #admin role for the people who need it: an administrator can change every repository and every account.

Step 8: Git over SSH

Gitblit's SSH server listens on 127.0.0.1:29418 and accepts public keys only. Gitblit offers no password method over SSH, and its keyboard-interactive method never prompts and never succeeds.

Add your public key in the web interface: the menu under your user name (top right), my profile, then SSH Keys. Paste the contents of your ~/.ssh/id_ed25519.pub (or another public key) and choose the permission the key carries (RW by default; the key never has more than your account):

Use it through an SSH tunnel (nothing to open): forward a local port to Gitblit's SSH server over your normal SSH connection, then use localhost in the repository URL:

ssh -N -i <your-key.pem> -L 29418:127.0.0.1:29418 ubuntu@<public-ip> &
git clone ssh://admin@localhost:29418/hello.git

Or open it to your network. Three changes, all yours to make:

1. Let Gitblit listen on every address: in /etc/gitblit/gitblit.properties set git.sshBindInterface = (empty), and web.showSshDaemonUrls = true so the repository page shows SSH clone URLs.
2. Let the Gitblit service accept connections from your network. Its systemd sandbox allows the loopback address only; add your client network (it also lets Gitblit send traffic to that network, never to the metadata service):

text sudo mkdir -p /etc/systemd/system/gitblit.service.d printf '[Service]\nIPAddressAllow=<your-client-cidr>\n' | sudo tee /etc/systemd/system/gitblit.service.d/60-ssh-clients.conf sudo systemctl daemon-reload && sudo systemctl restart gitblit

1. Allow TCP 29418 in the instance's security group from that network only.

Then git clone ssh://<user>@<host>:29418/<repository>.git. Gitblit's host keys were generated on your instance's first boot; compare them with what your SSH client shows:

ssh-keyscan -p 29418 127.0.0.1 2>/dev/null | ssh-keygen -lf - | awk '{print $1, $3, $4}' | sort

2048 [127.0.0.1]:29418 (RSA)
256 [127.0.0.1]:29418 (ECDSA)
256 [127.0.0.1]:29418 (ED25519)

The fingerprints (the second field of ssh-keygen -lf -) are unique to your instance. Gitblit's unauthenticated git daemon (port 9418) stays off; there is no setting on this image that turns it on without a change to the service's command line.

Step 9: Push hooks, plugins and other features left off

Gitblit can run Groovy scripts before and after a push, and load plugins. Both run inside the Gitblit service, as the gitblit account, with access to every repository and account. Treat them as administrator-only:

• groovy.scriptsFolder is /etc/gitblit/groovy and plugins.folder is /etc/gitblit/plugins. Both are owned by root, empty, and read-only to Gitblit, so a Gitblit user, even an administrator in the web interface, cannot add a script or plugin. Only root on the instance can.
• No script is enabled (groovy.preReceiveScripts and groovy.postReceiveScripts are empty). Upstream's sample scripts are kept for reference, not executable, in /usr/share/doc/gitblit/groovy-samples.
• To use a hook, review the script, then copy it as root into /etc/gitblit/groovy and name it in groovy.preReceiveScripts or groovy.postReceiveScripts (all repositories), or in a repository's settings. Restart Gitblit.

Also off on this image, each a setting in /etc/gitblit/gitblit.properties (upstream's documentation of every key is /etc/gitblit/defaults.properties):

• Federation (federation.passphrase empty, federation.allowProposals = false): no other Gitblit can pull your repositories or accounts, and nginx answers 404 for /federation/.
• The git daemon and fanout (git.daemonPort = 0, fanout.port = 0).
• RPC administration and management (web.enableRpcManagement and web.enableRpcAdministration false): the RPC API can list repositories and branches for a signed-in user, but cannot change settings, accounts or repositories.
• Mirroring (git.enableMirroring = false): Gitblit never fetches from another server.
• Cookie sign-in (web.allowCookieAuthentication = false).

After changing the file, run sudo systemctl restart gitblit. Read the comments marked [security] in the file before changing those values.

Step 10: Your own host name and certificate

On every boot gitblit-set-host works out the name to serve: the name you set, else the instance's public DNS name from the instance metadata service (IMDSv2). Gitblit builds its clone URLs from that name:

systemctl is-enabled gitblit-set-host.service
sudo gitblit-set-hostname --boot

enabled
gitblit-set-hostname: unchanged (ec2-203-0-113-10.compute-1.amazonaws.com)

Use your own DNS name. Point a DNS record at the instance (an Elastic IP keeps the address fixed), then run sudo gitblit-set-hostname git.example.com. The name is kept in /etc/cloudimg/gitblit-hostname for every later boot, the credentials file is updated, nginx serves that name and redirects the instance's other addresses to it, and clone URLs become https://git.example.com/r/.... Because the certificate in place was the one cloudimg generated, it is re-created for the new name.

Which certificates are replaced. Only a certificate cloudimg generated is ever re-created: its SHA-256 fingerprint is recorded, root owned, in /var/lib/cloudimg/gitblit-cert.sha256, and a certificate is treated as cloudimg's only while it matches that record:

sudo cat /var/lib/cloudimg/gitblit-cert.sha256
openssl x509 -in /etc/ssl/gitblit/gitblit.crt -noout -fingerprint -sha256

38:1D:8B:33:0B:BC:51:0C:65:24:84:46:AF:F4:07:35:50:6B:0C:F3:37:15:FC:B2:31:F0:42:14:CA:35:E5:2B
sha256 Fingerprint=38:1D:8B:33:0B:BC:51:0C:65:24:84:46:AF:F4:07:35:50:6B:0C:F3:37:15:FC:B2:31:F0:42:14:CA:35:E5:2B

Install your own certificate (from your CA, or Let's Encrypt with a DNS challenge) by putting the full chain and the key at the same paths. Anything there that does not match the record is yours and is never replaced, not on boot and not when the name changes:

sudo install -m 0644 -o root -g root fullchain.pem /etc/ssl/gitblit/gitblit.crt
sudo install -m 0600 -o root -g root privkey.pem /etc/ssl/gitblit/gitblit.key
sudo nginx -t && sudo systemctl reload nginx

Go back to a generated certificate by removing both files and running the helper with the name to serve:

$ sudo rm /etc/ssl/gitblit/gitblit.crt /etc/ssl/gitblit/gitblit.key
$ sudo gitblit-set-hostname git.example.com

To return to the instance's own public name on every boot, sudo rm /etc/cloudimg/gitblit-hostname && sudo gitblit-set-hostname --boot.

Step 11: Backups and updates

Everything Gitblit stores is under /var/lib/gitblit: the repositories in git/, the accounts in users.conf, the SSH keys users added in ssh/, tickets in tickets/, and the SSH host keys. Back it up with an EBS snapshot of the root volume, or stop Gitblit and copy the folder:

sudo systemctl stop gitblit
sudo tar -C /var/lib -czf /root/gitblit-backup.tar.gz gitblit
sudo systemctl start gitblit

Ubuntu packages, OpenJDK, nginx and git included, are updated by unattended security upgrades; to update everything now run sudo apt-get update && sudo apt-get upgrade, then sudo systemctl restart gitblit so Gitblit runs on the updated Java. Gitblit itself is not an apt package: it is the release in /opt/gitblit, and apt never changes it:

systemctl is-enabled unattended-upgrades apt-daily-upgrade.timer
dpkg -S /opt/gitblit/gitblit.jar 2>&1 || true

enabled
enabled
dpkg-query: no path found matching pattern /opt/gitblit/gitblit.jar

cloudimg publishes a new version of this listing when Gitblit has a new release or a security fix. To move, launch the new version and restore /var/lib/gitblit into it (stop Gitblit first, and keep the files owned by gitblit).

Security notes

• Credential first. nginx refuses any request without HTTP Basic credentials (401) before it reaches Gitblit, and Gitblit checks every credential itself (web.authenticateViewPages, web.enforceHttpBasicAuthentication). New repositories are VIEW restricted by default, and anonymous pushes are off.
• No outbound network for Gitblit. Its systemd unit allows IP traffic to the loopback addresses only (IPAddressAllow=localhost, IPAddressDeny=any), so neither a setting nor a push can make Gitblit fetch a URL, reach another host or the metadata service. Mirroring and federation are off as well.
• Instance metadata. Gitblit, nginx, first boot and the helper commands are denied the EC2 instance metadata service (169.254.169.254 and its IPv6 address) by systemd. Launch with IMDSv2 required (HttpTokens=required), as in Step 1.
• Forwarded headers. nginx sends Gitblit the configured host name, https and the real client address (X-Forwarded-For is set from the connection, never passed through) and drops client-supplied Forwarded and X-Forwarded-* headers. Gitblit's session cookie is marked Secure, HttpOnly and SameSite=Lax.
• Sandboxed process. Gitblit runs as the unprivileged gitblit account with a read-only view of the system (it can write only /var/lib/gitblit), a private /tmp, no capabilities and a system call filter. Its program files and settings are owned by root.
• Exact listeners. Only 22, 80 and 443 listen on the network (Step 3). Open them in the security group only to the networks that need them.

The metadata block and the network sandbox, as systemd applies them:

systemctl show gitblit nginx -p Id -p IPAddressDeny -p IPAddressAllow

IPAddressAllow=127.0.0.0/8 ::1/128
IPAddressDeny=::/0 0.0.0.0/0
Id=gitblit.service

IPAddressAllow=
IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32
Id=nginx.service

Build provenance and licence

Gitblit 1.10.0 is the upstream GO release (GitHub release v1.10.0). The image build downloads the release tarball, checks its SHA-256, and installs only gitblit.jar, the ext/ libraries, the licence and notice, upstream's settings reference, the .gitignore templates and the Groovy samples (as documentation). Upstream's service scripts and its default data/ folder, with the admin/admin account and sample repositories, are never installed. Every file under /opt/gitblit is listed with its SHA-256 in /usr/share/doc/gitblit/gitblit-files.sha256:

head -4 /usr/share/doc/cloudimg/gitblit-BUILD-INFO.txt
sha256sum /opt/gitblit/gitblit.jar
ls /usr/share/doc/gitblit/

Gitblit 1.10.0 on Ubuntu 24.04 (cloudimg AWS bundle member dev-cicd)
release tarball https://github.com/gitblit-org/gitblit/releases/download/v1.10.0/gitblit-1.10.0.tar.gz sha256 584d8ab046d52b7575ed928497de81beb3abd6d44f689075dac6fe2580561bbd; Apache-2.0, LICENSE sha256 5ad8c213095c573921d7388edf93f6a9f54490b8ebf3b165ae8ef1947cf70846 -> /usr/share/doc/gitblit/
jar /opt/gitblit/gitblit.jar sha256 5334b3a9637387ea91c1b4b9e8540bd7644f3990730345601352b6d34086f789; every file under /opt/gitblit: /usr/share/doc/gitblit/gitblit-files.sha256
raised ext/mina-core-2.0.27.jar -> mina-core-2.0.31.jar sha256 5322378fd9b7b609490bf373ca26418041aef3f9c27672d06db75564335b56e5 (Maven Central)
5334b3a9637387ea91c1b4b9e8540bd7644f3990730345601352b6d34086f789  /opt/gitblit/gitblit.jar
LICENSE
NOTICE
gitblit-files.sha256
groovy-samples

Raised libraries. Nine bundled libraries are replaced by their patched releases from Maven Central, each checked by SHA-256 and each inside upstream's own major and minor version: Apache MINA core 2.0.27 to 2.0.31, FreeMarker 2.3.22 to 2.3.35, Bouncy Castle (bcprov, bcpkix, bcutil, bcmail) 1.81 to 1.81.1, and Wicket (with its auth-roles and extensions) 1.4.22 to 1.4.23. The full list is in /usr/share/doc/cloudimg/gitblit-BUILD-INFO.txt. A vulnerability scan of /opt/gitblit still lists advisories in libraries Gitblit 1.10.0 bundles whose fixes are only in a newer major version; on this image their vulnerable code is not reachable without a credential, or not at all (for example the SSH server's features this image turns off, document parsers Gitblit does not use on uploaded content, and libraries for realms that are not configured). cloudimg publishes a new version when Gitblit ships updated libraries.

Gitblit's source: github.com/gitblit-org/gitblit (tag v1.10.0).

Troubleshooting

• The browser keeps asking for the password. The user name or password is wrong; read it again from /root/gitblit-credentials.txt (the user name is admin). After gitblit-set-password the old one is refused at once.
• 429 Too Many Requests. A client sent too many requests with credentials in a short time (a script retrying a wrong password, for example). Wait a few seconds.
• git: SSL certificate problem: self-signed certificate. Trust gitblit.crt with http.sslCAInfo (Step 6), or install your own certificate (Step 10).
• git: The requested URL returned error: 403 on push. The account has no push (RW) permission on the repository, or, for a new name, no right to create repositories.
• Clone URLs name the wrong host. Set the name clients use with gitblit-set-hostname (Step 10).
• The connection is dropped with no answer. The request named a host the instance does not serve. Use the name in GITBLIT_URL, or set yours with gitblit-set-hostname.
• SSH: Permission denied (publickey). The key is not on the account (Step 8), or you connected to port 22 (the instance's own SSH) instead of Gitblit's 29418.
• Logs: journalctl -u gitblit, /var/log/nginx/access.log and /var/log/nginx/error.log, and /var/log/cloudimg/gitblit-firstboot.log.

Support

cloudimg images come with 24/7 support. Email support@cloudimg.co.uk with your AWS account ID, the instance ID and the output of sudo /usr/local/sbin/gitblit-verify.sh. For Gitblit itself, see the Gitblit documentation and the settings reference in /etc/gitblit/defaults.properties.