Especially something like Gitlab might benefit a lot from external integrations that need to call the Gitlab API. It might be possible to whitelist exactly those requests, but also a bit cumbersome.

Gitlab is my favourite for running a codeforge: git.drk.sc

For a highly secure environment, I agree to practice even more defensible tactics, but I think software out to be designed to survive the open web.

yes, especially if you are using self hosted gitlab for your company, you should always put it behind corporate VPN.