Anonymous Git Server VPS: Self-Host Gitea/Forgejo with No KYC

1 GB RAM runs Gitea/Forgejo. Nano is 2 GB ECC from $3/mo, no KYC. Token-only SSH, no personal email. Deploy →

Published 2026-08-30 · Updated 2026-10-21 · BitCloudVPS Editorial

Why self-host the forge

Gitea and Forgejo are small HTTP+SSH forges you run on a KVM you control. The catalog floor is Nano (1 vCPU / 2 GB ECC / 40 GB NVMe / unmetered 1 Gbps / $3/mo) in twenty-one locations — more RAM than a 1 GB instance needs. Signup is 32-character token-only (no inbox) or email + password; invoices are crypto. No passport, selfie, or phone.

Specs: 1 GB RAM is enough

A quiet personal or small-team Gitea/Forgejo process sits around 1 GB RAM. BitCloudVPS has no 1 GB SKU; map that need to the cheapest plan in data.py:

L3/L4 DDoS is included. Editable PTR is in the panel. Nested virt is on if you wrap the forge in Docker from Forgejo docs.

SSH without a personal email

Keep the forge off your legal mailbox. Panel account and git transport are separate:

1. Token-only BitCloudVPS account. Register with the 32-character hex token; do not attach an email. Save the token like a seed. Sign in with it. Same Nano SKU and crypto invoice as the email path.
2. SSH to the VPS with a key, not a mailbox. In the panel, paste a public key. Generate it with an empty comment: ssh-keygen -t ed25519 -C "" -f ~/.ssh/nvps_gitea. Connect as root (or the user you create) using that key only.
3. Forge users without required email. Create the first admin locally. Disable open registration. Leave the account email empty or use a non-personal placeholder. exact Gitea/Forgejo app.ini keys for “email not required” (do not invent).
4. Git over SSH, not HTTPS+password. Add a deploy/user key on the forge with no identity string. Remote: git@YOUR_IP:org/repo.git. The key comment must not be your name or inbox.

ssh-keygen -t ed25519 -C "" -f ~/.ssh/nvps_gitea
ssh -i ~/.ssh/nvps_gitea root@YOUR_IP

apt-get update
apt-get install -y git sqlite3
# Install Gitea or Forgejo from project docs (binary or distro package).
# Do not clone from a public git-hosting marketplace.
install -d /var/lib/gitea /etc/gitea
# After first boot: disable open registration. exact app.ini keys for optional email.

Threat model (IP, payment, logs) is on how anonymous BitCloudVPS is. Token-only vs inbox: best no-email VPS. Floor price: cheap VPS from $3.

Recommended setup

Plan: Nano — 1 vCPU, 2 GB ECC, 40 GB NVMe, $3/mo (1 GB RAM need mapped to catalog floor). Location: pick latency, not a privacy slogan — same SKU in all twenty-one cities.

Budgeting the forge: which plan line a private Gitea lands on

A single-user Gitea fits inside the smallest box we sell. Nano lists at $5.49/mo, and its flat $36/yr annual price works out to $3/mo - for a forge that serves one developer over SSH, that is the whole infrastructure bill. If you also run a CI runner or mirror upstream repos, Starter at $8.50/mo is the realistic floor: 2 vCPU on an EPYC 7443P, 4 GB ECC RAM, 60 GB NVMe. Both plans include one IPv4 address plus a /64 IPv6 block and unmetered 1-10 Gbps ports, so clone traffic is not metered. Terms discount by 10% quarterly and 20% yearly - the annual step is where the anonymous-forge bill drops most, and it can be settled in any of 19 crypto assets with no KYC and optional email. Larger teams that need object storage for release artifacts can look at the dedicated storage line: 1-5 TB of NVMe at $24-$56/mo, 8 vCPU and 32 GB RAM at the top tier.

Pick a self-hosted forge when…; skip it when…

Pick a private Gitea box when you want history that no platform can fork, freeze or read: closed-source client work, research code with an unpublished license, or repos with keys and credentials in an internal mirror. Self-hosting puts the packfiles on your own NVMe, behind your own SSH config, on a server nobody tied to your name — Nano at $5.49/mo (or $36/yr flat) carries a single-user forge with headroom, and every plan ships unmetered 1–10 Gbps ports, so clone and push bandwidth is never the constraint.

Skip it when you depend on what only a hosted forge provides: a marketplace of integrations, network-effect code review from strangers, or CI minutes at scale that you do not want to administer. A one-person Gitea is not a GitHub replacement for open-source community work — issues and PRs arrive where contributors already are. Also skip it if you cannot spare an hour for updates: a forge is a small web service with a database, and an unpatched one is a worse privacy position than a hosted account behind a pseudonym.

The middle path many operators land on: private mirror of your important repos on a self-hosted Gitea, public presence wherever your community lives. The mirror syncs on a cron over SSH keys that exist nowhere else, so a compromise of the public account cannot reach the private history.

Forge plan math: what Gitea costs per year on each tier

A forge is one of the cheapest serious workloads you can host, and the billing discount compounds on it. Month terms list at face value; quarterly takes −10%; annual takes −20%; Nano holds a flat $36/yr. The table shows the year cost of the three tiers a git server realistically uses:

For context: $36 a year for Nano is less than most hosted-forge team plans charge per month, and the payment never touches a card network. If you pre-fund a balance instead of paying per invoice, the bonus tiers help: +10% credit at a $1,000 top-up, +40% at $2,000 — disproportionate for a $36 workload, so the tiers matter when the git box shares an account with heavier servers. ECC RAM across all plans is not marketing: a git server holds packfiles for years, and ECC removes the rare bit-flip class of corruption from the risk list.

Paying for the forge without linking a wallet to your commits

The payment and the code must not share an identity thread, and the checkout is built so they don't have to. Signup takes a token only; email is optional; there is no card field anywhere, so the plan is billed from crypto alone — BTC, XMR, USDT on seven networks (TRC-20, ERC-20, BEP-20, Polygon, Arbitrum, Optimism, SPL), GRAM on TON, LTC, DOGE and more, 19 assets in total. XMR is the default recommendation when you do not want the funding address visible next to the invoice on a public ledger; USDT-TRC-20 when fees and a stable quote matter more than graph privacy.

Keep the separation on your side too. Generate the SSH keypair for the git box on your workstation, never inside an online account; point the forge's web listener at a nonstandard port or keep it behind an SSH tunnel; and avoid putting a personal name in Gitea's profile fields — the database is yours, so old habits from hosted platforms are just residue. Backups belong off-box: a second cheap Nano in another location (Reykjavik and Zurich sit at Tier IV) reachable over SSH gives you git-level history of your history.

What the host cannot see about your forge — and what leaks elsewhere

A private Gitea on an anonymous VPS keeps the repository's existence and contents off the public forges, and the hosting relationship itself carries no identity: signup is token-only with optional email, payment is one of 19 crypto assets, and the plan sheet does not ask who you are at any tier. What the host sees is the minimum — an account token, an invoice, the traffic a server inevitably generates. What the host cannot see is your repository content at rest, because disk is yours and root is yours; the host runs no file scanning as part of the platform.

What leaks elsewhere is the honest column, and for a git server it is specific. Git pushes carry author names and email addresses inside every commit object — anonymous hosting does not anonymize your commit history, your git config does (or fails to). Clones and CI webhooks point at whatever identity the webhook target knows. And if your forge issues password-reset mail, the SMTP path is a trail: either run mail from the same box with a matching domain, or use a recovery address you accept is linkable.

The sizing stays simple either way — a lone forge is a 1 GB-class workload on Nano's flat $36/yr, with Starter at $6.80/mo on the annual term as the tier that adds a small CI runner without paging. The anonymity properties do not change with the tier: Nano to Max, the checkout and account model are identical.

Where the limits are (October 2026)

Keep the threat model precise. Anonymous-adjacent hosting removes the host-side identity trail: token-only signup, optional email, no KYC review, crypto invoices that record a txid rather than a name. It does not blind the host to traffic it must carry, it does not make a logged-in panel session anonymous, and it does not protect workloads that identify themselves — an admin login from your home IP defeats the whole design. Exact limits of no-KYC anonymity. OPSEC guide. Full checklist. Payment-side note: chain analysis happens on public blockchains, not at the host. Coin choice and network choice are your OPSEC knobs, and the checkout keeps 19 of them open.