Contabo

A fresh Gitea install is designed to be easy to get running- but that default also could leave the web installer open, user registration unrestricted, and new repositories public.

Read how to build on a solid VPS baseline (SSH key auth, Contabo Firewall, Fail2Ban, non‑root sudo user, regular patching) and then lock down Gitea itself: app.ini settings like INSTALL_LOCK and DISABLE_REGISTRATION, 2FA enforcement, access token hygiene, private‑by‑default repos, branch protection, and a hardened Nginx reverse‑proxy config with the headers Gitea expects.

Article linked in the comments 👇