Documentation Edit this page

Git SSH Server

A standalone Git SSH server (git.javagitsshserver) that hosts bare Git repositories accessible over the SSH protocol, supporting git clone, git fetch, and git push via git-upload-pack and git-receive-pack. It is built on Apache MINA SSHD and Eclipse JGit, and authenticates clients using SSH public keys.

Unlike most services in this catalog, this is not a ContainerNursery service. It runs as a long-lived JVM process directly on a DigitalOcean droplet, occupying the standard SSH port (22).

Routes

This service does not use ContainerNursery routing (no HTTPS or url:// route). It is reached directly over SSH:

Architecture

Git client ──SSH (port 22)──► git.javagitsshserver (JVM on droplet 198.199.106.165)
                                 │  Apache MINA SSHD + Eclipse JGit
                                 │  public-key auth
                                 ▼
                               Bare repositories under /home/git-repos

Single standalone process — there is no WUI, ServiceServer, or url:// layer. The server resolves the requested repository under its repositories directory and executes the corresponding JGit pack operation.

Repositories

The older javagitsshserver repo is an archived duplicate of the same project and should not be used.

Hosting

• Host: DigitalOcean droplet 198.199.106.165.

• Port layout: This Git SSH server owns port 22, so clients use the default SSH port (no -p flag needed). The droplet's interactive OpenSSH daemon has been moved to port 23 for shell administration:

  ssh -p 23 root@198.199.106.165
  

  The OpenSSH daemon config lives at /etc/ssh/sshd_config; after editing it, restart with systemctl restart sshd.

• Host key: The server's SSH host key is jim_id_rsa_20140720.private (passed to the server via --server-certificate).

• Repositories and user: Bare repositories live under /home/git-repos, owned by a dedicated git system user (sudo useradd -m -r -U -d /home/git-repos git). Authorized client public keys are stored in ~git/.ssh/authorized_keys.

• Droplet resources: The droplet is memory-constrained, so a 3 GB swapfile is configured at /swapfile and persisted in /etc/fstab (/swapfile none swap sw 0 0). Keep this in mind when sizing JVM heap.

Dependents

• Self-hosted Git repositories pushed to this server by developers/clients.

Deployment

Built and run as a fat JAR directly on the droplet (not via ContainerNursery). From the git-javagitsshserver repo:

# Build the executable fat JAR
scripts/build.bash git.javagitsshserver.buildFatJar

On the droplet, launch the server against the repositories directory (port 22 is the default):

sudo java -jar git-javagitsshserver-fat.jar --repositories /home/git-repos &

To add a new hosted repository:

# On the server
cd /home/git-repos && mkdir my-project.git && cd my-project.git && git init --bare

# On a client (port 22, so no -p needed)
git remote add origin 198.199.106.165:my-project.git/
git push --set-upstream origin main

Health Checks

• SSH reachability on port 22: nc -z 198.199.106.165 22 should succeed.
• A functional check is an authorized git ls-remote 198.199.106.165:<repo>.git/ returning refs.

Notes

• The port-22 (Git) / port-23 (interactive sshd) split is the key operational gotcha: administrators must SSH to port 23, while Git clients use the default port 22.
• Access management is currently hardcoded in Main.kt (isAuthorized()); changing who can access which repository requires a code change and redeploy.
• Because the server runs as a single long-lived JVM on a shared, memory-constrained droplet, restarting it interrupts all in-flight Git operations.