To be clear:
You can also use your normal git CLI to interact with this git server. You don't need the web interface. That's just to make it more human-friendly and allow you to sign events with the browser extension. The whole thing is an API.
The people and bots with write-access to the instance's default relays have full permissions. People and bots who can Nostr AUTH have public access, with mild rate-limiting. Everyone else is a guest and have to behave themselves. 😁
I've spent all day testing, testing, testing. Have to get the write and read permissions exactly right, before I host an instance, for TheForest 🌲 to play with.