Why are we still debating SSH versus HTTPS in 2026?
For cross-border teams, Git is not just “clone and go”—it is traffic that must traverse corporate firewalls, international paths, and audit rules every day. SSH (typically port 22) favors long-lived connections and key-based identity. HTTPS (port 443) lines up with HTTP proxies and token-centric SaaS platforms. Failure modes look nothing alike; mixing protocols without a single credential story is the hidden tax on CI debugging hours.
What each protocol does best
SSH: machine identity and tight repo scoping
Deploy keys, ssh-agent, known_hosts, and ProxyJump form one coherent story. That fits self-hosted runners, repo-scoped authorization, and teams that already jump through bastions. The catch: if your enterprise only allows outbound 443, raw SSH may be silently dropped unless you add an SSH-over-HTTPS tunnel or a gateway—plan for that before you standardize.
HTTPS: platform tokens and a single proxy exit
Personal access tokens, OIDC federation, and credential helpers usually need less glue when CONNECT to 443 is the only hole. Large repositories also pair naturally with fetch optimizations—see Large repos & CI: partial clone, sparse checkout, or dependency caching? for checkout-side tactics that sit next to transport choice.
Decision matrix: pick a default by scenario
| Scenario | Lean SSH | Lean HTTPS |
|---|---|---|
| Only 443 allowed / strict HTTP proxy | Needs tunnel or gateway | Native fit |
| Many private repos, machine CI (deploy keys) | Clear key boundaries | Broad PAT blast radius |
| Hosted OIDC into cloud roles | Possible, more wiring | More examples & docs |
| Long sessions, large object transfer | Mature connection reuse | Depends on HTTP/2 stack |
| Audit wants “who hit which URL when” | Needs logging front-end | Aligns with WAF logs |
Matrix rows are defaults, not permanent bans: mixed fleets often use HTTPS on developer laptops and SSH in the data center because two teams own different risks. Capture each carve-out in runbooks so on-call engineers are not guessing.
If security mandates 443-only egress, either fund an SSH gateway early or standardize on HTTPS and invest in OIDC plus short-lived tokens instead of chasing a protocol you cannot legally ship.
Proxies, credentials, and what “stable” means
On international links, average RTT can mislead; CI cares more about jitter and surprise resets, because a few hundred milliseconds of extra variance per fetch multiplies across matrix jobs and submodule hops. SSH through proxies needs TCP keepalives and jump config baked into runner images. HTTPS needs corporate roots in the container trust store and discipline so PATs never echo in logs. Either way, rotate secrets on a calendar—not only after incidents.
When you stand up adjacent automation, networking and volume patterns from OpenClaw self-hosted deployment (CLI to Docker) map cleanly to how you persist credentials on long-lived hosts.
git fetch time—monitor TLS handshake and time-to-first-byte, not ping alone.
Unattended runner checklist
-
One story per job: unify
~/.ssh/configor a credential helper so submodules do not mix protocols with the main remote. - Least privilege: per-repo deploy keys; PATs with narrow scopes and short lifetimes.
- Observable failover: classify failures as DNS, TLS, proxy, or auth; keep a read-only mirror or backup remote when the primary transport blips.
FAQ
Run this stack on a quiet, always-on Mac mini
Once transport and credentials are settled, you still need a host that stays online without fan noise or surprise reboots. macOS ships OpenSSH and Keychain integration out of the box, so both SSH and HTTPS workflows need fewer brittle shell wrappers. Mac mini with M4 delivers strong Apple Silicon performance at roughly four watts idle—ideal for home-lab or colocated runners that sit between CI bursts.
Stability matters: macOS crash rates stay low for unattended services, and Gatekeeper, SIP, and FileVault together reduce whole classes of malware risk compared with typical Windows build PCs. The same machine lines up with Xcode and signing, which shortens mean time to diagnose flaky remotes.
If you want the policies above to live on hardware that matches iOS release cadence and keeps idle power negligible, Mac mini M4 is one of the most cost-effective anchors for macOS CI today—explore clonzone Mac mini cloud and pair it with the monitoring you just defined.