Yes, hosting the site seems much safer (at least in theory) since I am proxying it through cloudflare and I am planning on putting ngynx too on top of that this afternoon

(And signup is disabled, so hopefully only trusted users can access it)

A good suggestion, but it would still be hasslesome to setup. Plus, my friend would have to connect to the vpn whenever he wants to push/pull the repo

Yes, or else I wouldn’t have access to the web interface haha

I’d rather not say which router I have since it would reveal quite a bit of information about me. However, I do know that the connections that my router allows are tcp and udp

That’s also a possibility, yes. Probably what I should do, taking the rest of the answers into account

I see, only allowing established traffic to connect sounds like something that could work. But I don’t know how I can do this, do you have some pointers :)?

Blocking outgoing traffic and having to whitelist forgejo seems a bit extreme though

The reason why I am asking this question is because I think that the ssh port I am opening only has access to my repos (which means that even if I somehow get hacked the damage is minimal) and it doesn’t accept any keys aside from mine and my friend’s, which we set up through the web interface :).

I have wireguard setup and I’d also thought about sharing a tunnel with my friend, but it seemed much more hasslesome than simply opening the port, not to mention the fact that if anyone wanted to join too I’d have to do that again.

It is exactly because I am afraid of getting fucked that I am asking this and being careful. For now, my idea is to only open the port when someone is about to use it, since I am not absolutely sure that it won’t somehow accept a request from a person with less than noble intentions. (either that, either simply use tokens)

Reverse proxying was also my intention at first, but I just couldn’t get it to work with cloudflare for some reason!

Thanks for the insight!

I am still very much a noob to self-hosting, but I am not the one managing this ssh port, forgero is. Is there not any difference between the two? I think you can only access the forgejo ssh if you have a matching private key for one of the user’s public keys…

(And although it surprised me too, I couldn’t find information about the safety of specifically this online)