A software forge and its restoration
My self-hosted GitLab , with its registry and its , and proof that it restores entirely from its encrypted backup.
In serviceWhat it is
In September 2026, I set up my own GitLab forge at OVH. It hosts my repositories and my cohorts’ projects, and it comes with a Docker image registry and unprivileged runners, that is, executors that do not have administrator rights on the machine that carries them. Active repositories have private copies there, and the first of my projects to move over made it its reference.
How it works
The installation is scripted and versioned. Each version upgrade follows the path required by the vendor, with its mandatory stops, and I keep the record of what was checked at each step. The permanent runner is not privileged: it carries a tag, runs one job at a time and attaches a single service to it. Jobs that build Docker images run on another executor, reserved for a single project.
An encrypted backup goes out every night to separate storage, pulled by BorgBackup from a machine that does not depend on the forge, and its freshness is checked every hour. I restored the forge entirely on an isolated network, without touching the one in service, and it came back complete.
Why it exists
I wanted a place where my pipelines run without depending on a third-party host, and the forge is the answer. It also hosts my cohorts’ projects. As for the full restoration, it comes from a simple question: to know whether a backup is any use, you have to use it, so I did it for real, on an isolated network.