# Deployed the company's own git forge on Soft Serve, private by default with no web panel and its SSH port bound to loopback behind a jump host, and made the landing page in front of it a build artefact of the main site rather than a hand‑kept copy. 2025 **Situation.** The company's source code lived on a third‑party hosting service, which is a reasonable place for it and a poor fit for a business whose argument to clients is that it does not hand their data to intermediaries. Running a forge instead means running a forge: authentication, access control, storage, backups, and a public face for it. **Task.** A canonical git server had to be stood up on the existing host, with the smallest possible attack surface and no web administration panel, and a landing page in front of it that does not rot. **Action.** The forge is a single binary supervised by the operating system, installed from its vendor's package repository, deliberately chosen for being SSH‑first with no administrative web interface — the less interface, the less to defend. It is private by default: anonymous access is refused, keyless access is refused, and every declared repository is marked private rather than relying on obscurity. Its SSH listener binds only to the loopback interface on port 23231 and is reached from outside through a jump host, so the firewall's declared surface does not grow. A protocol multiplexer that would put HTTPS and git SSH on one public port by inspecting the first bytes of a connection is written and ready behind a master switch, and that switch is off: multi‑user git over the public port is not needed yet, and a listener nobody uses is surface. The landing page in front of it was the more interesting problem. It had been a hand‑maintained copy of the main site's design in its own repository, and every single difference ever found between the two turned out to be an accident rather than a decision: a type scale rendering the wordmark about nine per cent too large, a font declaration that collapsed two weights to one on any machine with the family installed, ornaments hidden below a certain width so they were absent on every phone, a weight used with no font shipped for it, and no main landmark or top‑level heading on any page. Five for five, and not one visible in a screenshot. The copy was deleted; the landing page is now built by the main site's own templates and delivered as an artefact. **Result.** The company hosts its own code on its own hardware, and the page in front of it inherits every check the main site passes rather than drifting away from it in ways only a measurement can see. Divergence is still available and now has to be written down. --- - Role: Linux Systems Administrator - Categories: [Web Development](https://engineer.company/categories/web-development/), [DevOps](https://engineer.company/categories/devops/), [Infrastructure](https://engineer.company/categories/infrastructure/), [Automation & CI/CD](https://engineer.company/categories/automation/), [Linux & Servers](https://engineer.company/categories/linux/), [System Administration](https://engineer.company/categories/system-administration/) - Services: [Website Development & CMS](https://engineer.company/services/web-development/), [Infrastructure as Code](https://engineer.company/services/infrastructure-as-code/), [DevOps & CI/CD Automation](https://engineer.company/services/devops-cicd/), [System Administration](https://engineer.company/services/system-administration/)