How to harden your self-managed GitLab instance

This post provides a practical guide for hardening self-managed GitLab instances, focusing on seven key areas: enabling multi-factor authentication, enforcing additional sign-up checks (email confirmation, password complexity, allowed domains), limiting public visibility of groups and projects, hardening SSH settings (protocols, key types), reviewing account and limit settings (attachments, pushes, session duration, token lifetime), securing CI secrets with encrypted containers (recommending HashiCorp Vault and TLS 1.2+), and protecting pipelines for all branches (including protected environments). It emphasizes layered security and reducing the attack surface, aligning with GitLab's transparency and open-source principles.