Contents

TLS Enterprise

Agents send changed source files and tokens to the team server. Use HTTPS for every connection that leaves a network you fully control.

Two ways

Way	Use when
TLS at an ingress or load balancer	Kubernetes, or a cloud load balancer that already holds your certificates.
TLS in the server	Unikernel VMs, single machines, or when you want encryption up to the server itself.

TLS in the server

Give the server a certificate chain and a private key, both as PEM files.

Terminal

$ gitta server --listen 0.0.0.0:8443 --tls-cert fullchain.pem --tls-key privkey.pem

Or set GITTA_TLS_CERT and GITTA_TLS_KEY. The server then speaks only HTTPS on that port. It refuses plain HTTP. TLS 1.2 and 1.3 are supported.

Without a certificate, the server warns at start:

Terminal

gitta server: plain HTTP: put TLS in front (ingress, load balancer) or pass --tls-cert and --tls-key

Private certificate authorities

If your certificates come from your own certificate authority, tell each machine where its certificate is:

Terminal

$ export GITTA_SERVER_CA=/etc/ssl/example-root-ca.pem

Renew certificates

The server reads the certificate at start. After a renewal, restart the server. With several servers, restart them one at a time. On unikernel VMs, deploy a new image.

To run more than one server, see High availability. For how people and runners get tokens, see Tokens and sign-in.