GitLab instance: security best practices

What this post added

This post details security best practices for self-managed GitLab instances, focusing on hardening configurations. It covers strong password management for root and users, enabling Let's Encrypt for SSL/TLS, securing SSH access with support for RSA (2048-bit+) and ED25519 keys, and recommending passwordless SSH. It also outlines sign-up restrictions (disabling open sign-up, requiring email confirmation, domain whitelisting, minimum password length of 12), sign-in restrictions (requiring 2FA, disabling password authentication for Git over HTTP(S)), and visibility/privacy settings (defaulting projects to private). Additionally, it addresses network performance and stability by recommending user and IP rate limits, restricting webhook outbound requests to public services, and enabling protected paths rate limits.