Updated: 2025-10-18 07:38
Scope: Complete workflow to run a private Git service (Gitea) on a Synology NAS and use it from a MacBook with VS Code over SSH or HTTPS.
Covers deployment, reverse proxy, TLS, user/repo management, SSH keys, VS Code integration, security, backup and maintenance.
git.arp-ict.nl served by GoDaddy wildcard).git --version), OpenSSH (macOS builtin)./bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)").Create persistent folders on your NAS (File Station or SSH):
/volume1/docker/gitea
docker-compose.yml (store in /volume1/docker/gitea/compose/docker-compose.yml):
version: "3.8"
services:
gitea:
image: gitea/gitea:latest
container_name: gitea
restart: unless-stopped
environment:
- USER_UID=1026 # adjust to your DSM user UID (id <user> on SSH)
- USER_GID=100 # typically "users" group
- TZ=Europe/Amsterdam
- GITEA__server__ROOT_URL=https://git.arp-ict.nl/
- GITEA__server__SSH_DOMAIN=git.arp-ict.nl
- GITEA__server__SSH_PORT=226
- GITEA__service__DISABLE_REGISTRATION=true
- GITEA__security__INSTALL_LOCK=true
volumes:
- /volume1/docker/gitea:/data
ports:
- "3000:3000" # HTTP (behind reverse proxy)
- "226:22" # SSH for git+ssh
Bring it up:
cd /volume1/docker/gitea/compose
docker compose up -d
docker ps --format "table {'{'}.Names{'}'} {'{'}.Image{'}'} {'{'}.Ports{'}'} {'{'}.Status{'}'}"
Open: http://<NAS-IP>:3000 → initial Gitea setup wizard will use /data automatically.
Create the admin account (e.g., user danny).
We will publish through HTTPS at
https://git.arp-ict.nlvia DSM reverse proxy in the next step.
Map https://git.arp-ict.nl → http://127.0.0.1:3000
Control Panel → Login Portal → Advanced → Reverse Proxy → Create
| Field | Value |
|---|---|
| Description | Gitea |
| Source Protocol | HTTPS |
| Source Hostname | git.arp-ict.nl |
| Source Port | 443 |
| Destination Protocol | HTTP |
| Destination Hostname | 127.0.0.1 |
| Destination Port | 3000 |
| Destination Path | (leave empty) |
Custom Headers (recommended):
Host: $hostX-Forwarded-For: $remote_addrX-Forwarded-Proto: httpsTLS: Assign your GoDaddy wildcard *.arp-ict.nl certificate to this reverse proxy/virtual host (Control Panel → Security → Certificate).
Verify in a browser: https://git.arp-ict.nl should render Gitea over HTTPS.
react-dashboard → visibility: Private → Initialize with README (optional).Repo URLs (will be shown by Gitea):
git@git.arp-ict.nl:danny/react-dashboard.githttps://git.arp-ict.nl/danny/react-dashboard.gitSSH keys are the preferred auth method for Git over SSH.
# create a modern ed25519 keypair (no passphrase -> press Enter thrice)
ssh-keygen -t ed25519 -C "macbook@arp-ict.nl"
# prints public key:
cat ~/.ssh/id_ed25519.pub
Add the public key to Gitea:
Profile → Settings → SSH Keys → Add Key → paste content of id_ed25519.pub → Save.
Optional convenience: ~/.ssh/config
Host git.arp-ict.nl
HostName git.arp-ict.nl
User git
Port 226
IdentityFile ~/.ssh/id_ed25519
IdentitiesOnly yes
→ Lets you use short SSH forms and ensures the right key/port is used.
Test SSH:
ssh -T git@git.arp-ict.nl -p 226
# or just:
ssh -T git.arp-ict.nl
Expected: a greeting from Gitea (“Hi ! You've successfully authenticated…”).
From VS Code:
git@git.arp-ict.nl:danny/react-dashboard.git
CLI equivalent:
git clone git@git.arp-ict.nl:danny/react-dashboard.git
cd react-dashboard
code .
Common Git workflow:
git checkout -b feature/navbar
# edit files in VS Code...
git add .
git commit -m "Add navbar"
git push -u origin feature/navbar
You can also use HTTPS with a Personal Access Token (PAT) instead of SSH keys.
https://git.arp-ict.nl/danny/react-dashboard.git
To store credentials on macOS:
git config --global credential.helper osxkeychain
DISABLE_REGISTRATION=true already set)./volume1/docker/gitea with Hyper Backup (config, repos, avatars, LFS).docker pull gitea/gitea:latest
docker compose down && docker compose up -d
Cannot push via SSH
~/.ssh/config port = 226 and correct IdentityFile.ssh -T git@git.arp-ict.nl -p 226docker logs giteaWeb works but SSH fails
Repo URL confusion (SSH vs HTTPS)
git@git.arp-ict.nl:owner/repo.githttps://git.arp-ict.nl/owner/repo.gitPermission denied
Reverse proxy infinite redirect
X-Forwarded-Proto: https header is set.GITEA__server__ROOT_URL=https://git.arp-ict.nl/ is configured.Backup: include /volume1/docker/gitea in Hyper Backup.
Restore: pull the same gitea/gitea image tag, recreate container with the same volumes; Gitea will boot with all data intact.
If you only need bare repos over SSH:
mkdir -p /volume1/homes/danny/repositories/myrepo.git
cd /volume1/homes/danny/repositories/myrepo.git
git init --bare
git clone ssh://danny@nas.arp-ict.nl:/volume1/homes/danny/repositories/myrepo.git
No web UI, no issues/PRs, but simplest footprint.
Generate SSH key (Mac):
ssh-keygen -t ed25519 -C "macbook@arp-ict.nl"
cat ~/.ssh/id_ed25519.pub
~/.ssh/config entry:
Host git.arp-ict.nl
HostName git.arp-ict.nl
User git
Port 226
IdentityFile ~/.ssh/id_ed25519
IdentitiesOnly yes
Clone (SSH):
git clone git@git.arp-ict.nl:danny/react-dashboard.git
Clone (HTTPS):
git clone https://git.arp-ict.nl/danny/react-dashboard.git
Update container:
docker pull gitea/gitea:latest
cd /volume1/docker/gitea/compose
docker compose down && docker compose up -d
Author: Internal Infra Guide — Synology + Gitea + VS Code