iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
To self-host Gerrit on an Ubuntu VPS, install the Java runtime required by your selected Gerrit release, place the Gerrit WAR and site data in a persistent directory, initialize the site with production authentication, bind Gerrit to a private address, and publish it through Nginx or Apache with HTTPS. Back up the repositories, NoteDb review data, configuration, secrets, and plugins before inviting collaborators.
This guide covers a single-VPS deployment that you operate yourself: the Ubuntu operating system, Gerrit site directory, firewall, TLS endpoint, upgrades, monitoring, and recovery. It does not cover a hosted Git service operated by someone else.
What self-hosting Gerrit means
With a self-hosted installation, your VPS is the production environment. You choose the Ubuntu image and hostname, install the Java runtime and Gerrit release, control which network ports are reachable, configure authentication, and maintain the data. You are also responsible for security updates, disk capacity, TLS certificate renewal, logs, backups, and restore testing.
A practical public architecture keeps Gerrit off the public interface. The reverse proxy is the only service exposed on the HTTPS port; it forwards requests to Gerrit over a loopback address:
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Internet HTTPS
|
Nginx or Apache (public 443, TLS termination)
|
127.0.0.1:8080 (Gerrit proxy-https listener)
|
Gerrit site directory, repositories, indexes and pluginsThe exact local port is your choice. The important properties are that the listener is private, the proxy is trusted, and the proxy path and forwarded headers agree with Gerrit’s configuration.
Choose the release and size the VPS
Use the Java version required by the release line
The current standalone installation guide for the documented release line (accessed in 2026) states: “To run the Gerrit service, the following requirement must be met on the host: JRE, version 21.” Install a Java 21 runtime before initialization and verify that the command used by the Gerrit service resolves to that runtime, not an older system default. If you select a different Gerrit release line, read that release’s installation requirements rather than assuming the requirement is unchanged.
Recommended Free Tools
Do not treat an undocumented minimum as a capacity plan
The authoritative installation pages do not publish a universal CPU, RAM, disk, or concurrent-user minimum for an Ubuntu VPS deployment. Select capacity from the work your instance must perform:
| Workload factor | What to estimate | Why it affects capacity |
|---|---|---|
| Repositories | Number of repositories and their object counts | Each repository consumes storage and contributes to maintenance and indexing work. |
| History volume | Large binaries, long commit histories and tags | Git objects, pack files and backups grow with history, not only with the current checkout. |
| Indexing activity | Initial indexing, reindexing and search usage | Index work can create CPU, memory and disk bursts after installation or upgrades. |
| Review concurrency | How many people browse, search and upload changes at once | Concurrent web requests and SSH or HTTP operations determine headroom. |
| Recovery margin | Free space for temporary packs, snapshots and upgrades | A server that is full cannot complete maintenance or safely receive a backup. |
Start with measured workload assumptions, watch disk growth, memory pressure, CPU saturation and request latency, then resize the VPS before those signals become an outage. Record the assumptions so a later administrator understands why the chosen size was adequate.
Set a hostname and administrative access
- Point a DNS name such as
review.example.netat the VPS address before obtaining the public certificate. - Use a personal administrative account with
sudofor Ubuntu administration. Avoid performing routine work as root. - Create a separate service identity for Gerrit and ensure the site directory and its files are owned by that identity.
- Allow administrative SSH access only through the network policy you actually use; expose the Gerrit listener itself only to the local proxy.
Prepare Ubuntu
Install the runtime and basic tools
Update the operating system, install a Java 21 runtime from Ubuntu’s supported packages or your approved Java distribution, and confirm the version:
sudo apt update
sudo apt upgrade
java -versionThe output must identify a Java 21 runtime. If multiple Java versions are installed, select Java 21 for the service account and for every command that launches Gerrit.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Create persistent directories and a service identity
Keep the site directory on storage that survives a shell session, proxy restart or VPS reboot. The following is an operational pattern; adapt paths to your disk layout:
sudo adduser --system --home /srv/gerrit --group gerrit
sudo install -d -o gerrit -g gerrit /srv/gerrit
sudo install -d -o gerrit -g gerrit /opt/gerritDo not mix root-owned files into the site directory. Ownership problems commonly appear later when Gerrit tries to write configuration, repositories, indexes or logs.
Plan network exposure before starting
Decide which public ports the proxy will use for HTTP redirect and HTTPS, and which local port Gerrit will use behind it. A firewall should permit the public proxy ports and administrative access while denying direct access to the local Gerrit port. The proxy and Gerrit must run on the same VPS if you use a loopback address.
Download and initialize Gerrit
Obtain the WAR for the release you selected
Download the desired current WAR from the official Gerrit releases page, verify its integrity using the release information supplied with that download, and store it outside the site data directory. Keeping the executable separate from the site makes it easier to stage an upgrade while retaining the existing data.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo install -o gerrit -g gerrit /tmp/gerrit.war /opt/gerrit/gerrit.warThe filename above is an example path to the file you downloaded; use the actual file and release you selected. Keep a record of the release number and the Java version used for it.
Understand the quickstart command
The official quickstart demonstrates:
java -jar gerrit*.war init --batch --dev -d $GERRIT_SITEThis is useful for learning the layout and seeing a running instance, but the quickstart page explicitly describes that flow as a demonstration and directs production users to the standalone installation guide. The --dev authentication mode is therefore not a production access policy.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Initialize a production site
Run the standalone initialization workflow as the dedicated service identity. An interactive invocation with a persistent site directory looks like this:
sudo -u gerrit java -jar /opt/gerrit/gerrit.war init -d /srv/gerrit- Read each initialization prompt and select the production authentication method appropriate for your organization. Do not select the demonstration authentication mode for a public server.
- Confirm the site directory, repository location, and other paths before allowing initialization to write them.
- Record the administrator account and recovery method created by the chosen authentication backend.
- After initialization, inspect the generated configuration and verify that files are owned by
gerrit.
Arrange supervised startup using the Ubuntu service-management practice you operate. A service unit or supervisor should run the WAR as the Gerrit service identity, restart it according to your change policy, write logs where they are monitored, and stop cleanly during maintenance. The exact unit is an operational choice rather than a universal Gerrit requirement; validate it in your target Ubuntu release before relying on it.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Bind Gerrit to a private listener
Use a loopback address behind a local proxy
For a proxy on the same VPS, set Gerrit’s HTTP listener to loopback rather than a wildcard address. In the site configuration, the relevant form is:
[httpd]
listenUrl = proxy-https://127.0.0.1:8080/proxy-https:// tells Gerrit that the externally visible connection is HTTPS terminated by a trusted proxy. Gerrit also supports proxy-http://; choose it only when your external scheme and deployment design call for that mode. Externally facing production sites are strongly encouraged in the configuration reference to use a reverse proxy for SSL/TLS with the proxy-https:// scheme.
Protect forwarded headers
A proxy listener trusts information such as the original host and client address from the proxy. If untrusted clients can reach that listener directly, they may spoof forwarded headers. Restrict the listener with loopback binding and firewall rules so only the proxy can connect.
Restart Gerrit through your supervisor after changing the listener, then verify locally that it accepts connections on the selected address and port. Do not test by opening that port to the Internet; test through the eventual proxy endpoint.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Publish Gerrit through Nginx or Apache with HTTPS
Keep the public path and Gerrit path identical
Gerrit’s reverse-proxy guidance requires the proxy path to match the path in httpd.listenUrl. The simplest arrangement publishes Gerrit at the domain root, uses a root listener URL ending in /, and forwards the request URI without adding a second prefix. Path rewriting can break encoded repository paths, redirects, downloads and web-socket-like long-lived requests.
Preserve the public Host header and forward the client address. Also pass the external scheme so Gerrit generates HTTPS links instead of HTTP links.
Nginx configuration pattern
Nginx can terminate TLS on the public server block and proxy the root path to the private listener. The following pattern intentionally has no URI suffix on proxy_pass, so the incoming path is not silently replaced:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →server {
listen 443 ssl;
server_name review.example.net;
ssl_certificate /etc/ssl/review.example.net/fullchain.pem;
ssl_certificate_key /etc/ssl/review.example.net/privkey.pem;
location / {
proxy_pass http://127.0.0.1:8080;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}Use your certificate-management method and actual certificate paths. Add an HTTP server block that redirects the public HTTP name to HTTPS if you want a single canonical scheme. Validate the Nginx configuration before reloading it, and test both the login page and a repository operation after every proxy change.
Apache configuration pattern
Apache is also documented as a supported reverse proxy. Enable its proxy and request-header modules, preserve the incoming host, map the public root to the same private Gerrit root, and send the equivalent forwarded scheme and client-IP headers. The Apache ProxyPass and ProxyPassReverse mappings must use the same path on both sides; do not add a subdirectory unless Gerrit’s listener URL and every related rewrite intentionally use that subdirectory.
Proxy choice
| Decision axis | Nginx | Apache |
|---|---|---|
| TLS termination | Terminates HTTPS on the public server block and forwards to Gerrit. | Terminates HTTPS in the virtual host and forwards with proxy modules. |
| Header behavior | Set Host, X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-For explicitly. | Preserve the host and configure equivalent request-header forwarding. |
| Path handling | Use a root location and a proxy target without an unintended URI suffix. | Keep ProxyPass and ProxyPassReverse paths identical. |
| Logging | Use access and error logs to correlate public requests with Gerrit failures. | Use the virtual-host logs plus Gerrit logs for the same correlation. |
| Operational choice | Prefer it when your Ubuntu team already operates Nginx. | Prefer it when Apache is already the maintained front end. |
Neither proxy is inherently safer when its TLS, headers, path rules and update process are misconfigured. Familiarity and repeatable administration are useful deciding factors.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Verify the complete HTTPS path
- Resolve the hostname to the VPS address and confirm the certificate covers that hostname.
- Open the HTTPS URL and check that redirects remain on HTTPS.
- Confirm that Gerrit displays the public hostname, not
127.0.0.1or the private port. - Inspect proxy logs and Gerrit logs while loading a repository and a change page.
- Attempt a deliberately unauthenticated repository operation and verify that it is rejected rather than accepted anonymously.
Configure collaborator access
Choose an upload protocol
Gerrit supports authenticated uploads over SSH and over HTTP or HTTPS. The upload guide also describes web-based change creation and other workflows. Authentication must be configured before a user can push; a reachable login page alone does not prove that repository writes are protected.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Protocol | What the administrator must arrange | What the collaborator uses |
|---|---|---|
| SSH | Enable the SSH service exposed by Gerrit, configure the identity backend, and provide a way for each account to register a public key. | An SSH key pair, the Gerrit SSH username and the repository’s SSH clone URL. |
| HTTP or HTTPS | Configure the identity backend and the credential mechanism it supports; require HTTPS at the public proxy. | The account’s HTTP credential or token and the repository’s HTTPS clone URL. |
| Web-based change creation | Provide authenticated web accounts and repository permissions. | A browser session with the required project rights. |
Register identities and permissions
- Complete the chosen identity-provider setup during initialization or in the provider’s administration interface.
- Create an administrator account and a non-administrator test account.
- Have the test user register an SSH public key in the user profile’s SSH-key settings, or obtain the HTTP credential required by your backend.
- Grant only the project and branch permissions needed for the user’s role.
- Clone a test repository using the selected protocol, create a harmless change, and push it before onboarding the team.
Keep the SSH and HTTPS clone URLs generated by Gerrit as the source of truth. If the generated URL contains the private hostname or an unexpected scheme, fix the proxy headers and listenUrl before distributing it.
Back up Gerrit before inviting users
Back up the data that defines reviews
A Gerrit backup is more than a copy of bare Git objects. Modern Gerrit stores review metadata in NoteDb alongside repositories. A restorable set should include:
| Data | Why it belongs in the backup | Recovery note |
|---|---|---|
| All Git repositories | Contains source, branches, tags and Git objects. | Include the repositories that hold modern NoteDb review metadata, not only a working-tree export. |
etc configuration |
Contains site settings, authentication configuration and operational choices. | Treat secrets and credentials as sensitive; restrict backup access. |
| Installed plugins | Plugins can provide authentication, integrations or workflow behavior. | Record plugin versions and compatibility with the target Gerrit release. |
| Required data directories | Some deployments keep additional state outside repositories and etc. |
Inventory the actual site directory and document any external dependency. |
| Indexes and caches | Can shorten recovery and reduce reindexing time. | Usually rebuildable, so they are secondary to repositories, NoteDb, configuration and plugins. |
Take consistent snapshots
Do not copy files from a live, actively changing site and assume the result is transactionally consistent. Use a filesystem snapshot or an equivalent method that gives the backup a coherent point in time. If your storage cannot provide that, schedule a maintenance window and follow a documented quiescing procedure suitable for your Gerrit version.
- Define the recovery point and pause or coordinate writes according to your snapshot method.
- Capture the site data, repositories, configuration, secrets and plugins together.
- Record the Gerrit release, Java version, Ubuntu version, proxy configuration and identity-provider settings beside the snapshot.
- Resume service and confirm that new changes can be uploaded.
- Encrypt the archive where appropriate and copy it to storage separate from the VPS.
- Perform a restore test on an isolated system, verify that repositories and review metadata open correctly, and document the elapsed recovery time.
A second copy on the same VPS is not protection against disk loss, account compromise or a failed upgrade. Separate storage and tested restoration are the useful measures.
Operate and update the installation
Use a change window
Plan Gerrit upgrades as service changes, not as a replacement of one file while users are working. Read the target release’s upgrade notes, verify its Java requirement, test the upgrade against a restored copy, and keep a known-good backup before changing the production site. Stop or coordinate the supervisor according to the release procedure, run the documented initialization or migration step, then bring the service back through the supervisor.
Monitor the signals that predict failure
- Disk usage for repositories, packs, indexes, logs and backup staging.
- Memory and CPU during indexing, garbage collection and peak review activity.
- Proxy certificate expiry and renewal failures.
- Proxy access and error logs, plus Gerrit application logs.
- Backup completion, archive transfer and restore-test results.
- Authentication failures and unexpected permission changes.
Set alert thresholds from your baseline instead of adopting a universal number. Capacity and alert values should reflect the repository volume and reviewer concurrency you measured for this VPS.
Keep the public endpoint narrow
Only the reverse proxy needs to accept public web traffic. Continue to deny direct access to the Gerrit loopback port, keep administrative access separate, and review firewall rules after every network change. If the proxy and Gerrit are moved to different hosts later, replace loopback binding with a private network address and restrict that address to the proxy’s firewall identity; never expose a proxy listener to arbitrary clients.
Quick Recap
Troubleshoot common deployment failures
| Symptom | Likely cause | Correction |
|---|---|---|
| Proxy returns 502 or connection refused | Gerrit is stopped, listening on another port, or bound to a different address. | Check the supervisor status and local listener, then make the proxy target and listenUrl identical. |
| Links or redirects use HTTP | The external scheme is not reaching Gerrit. | Use proxy-https:// for TLS termination and forward X-Forwarded-Proto: https. |
| Links show the private hostname | The public host header was replaced or not preserved. | Preserve Host, forward the public host, and reload the proxy. |
| Requests fail only under a subpath | The proxy rewrote the URI while Gerrit expects another path. | Publish at the root or align the listener URL, proxy mapping and rewrite rules exactly; remove an unintended URI suffix from the proxy target. |
| Client addresses are wrong or can be spoofed | Forwarded headers are trusted from an untrusted network. | Bind privately and firewall the listener so only the known proxy can reach it. |
| Push is rejected for a valid user | Authentication, credentials or project permissions are incomplete. | Test the account login, re-register the SSH key or HTTP credential, and verify repository and branch permissions. |
| Restore starts but reviews are missing | Only Git source was copied; NoteDb, configuration or plugins were omitted. | Restore the complete repository set with NoteDb metadata, etc, plugins and required data directories. |
Deployment choices at a glance
| Choice | Advantages | Trade-offs |
|---|---|---|
| Direct Gerrit HTTPS | Fewer moving parts for a private experiment. | Does not follow the strongly encouraged reverse-proxy pattern for an externally facing production site; certificate, headers and public exposure are handled by Gerrit itself. |
| Gerrit behind Nginx or Apache | Centralizes TLS, public logging, redirects and network policy while Gerrit remains private. | Requires exact path and header configuration and another service to maintain. |
| SSH uploads | Convenient for command-line Git workflows once keys are registered. | Requires SSH identity management and careful exposure of the Gerrit SSH endpoint. |
| HTTP or HTTPS uploads | Fits environments that already manage web credentials and HTTPS egress. | Credential or token handling must be configured correctly; plain HTTP should not be the public scheme. |
| Local snapshots only | Fast to create and restore on the VPS storage. | Does not protect against VPS storage loss or compromise. |
| Snapshots archived off the VPS | Provides a separate recovery copy and supports disaster recovery. | Needs storage, encryption, transfer monitoring and regular restore tests. |
| Single VPS | Simple architecture and low operational overhead. | The host, proxy, Gerrit process and local storage remain a common failure domain; redundancy requires a more involved design. |
Production readiness checklist
- Hostname resolves to the VPS and the certificate covers it.
- Java 21 is installed for the selected documented release line.
- Gerrit runs from a persistent site directory under a dedicated service identity.
- Initialization used a production authentication method, not the demonstration
--devmode. - Gerrit listens on a private address and the firewall blocks direct public access.
- Nginx or Apache terminates TLS, preserves the host, forwards client-IP and scheme headers, and keeps the path unchanged.
- A non-administrator test account can authenticate and complete an authorized push over the chosen protocol.
- Backups include repositories with NoteDb metadata,
etc, secrets, plugins and required data directories. - Snapshots are archived separately from the VPS and a restore has been tested.
- Upgrade, monitoring, certificate-renewal and incident procedures are written down for the people who will operate the server.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
