Here is my situation:
I have a typical network setup, with DMZ and internal segment, with a VPN concentrator. Because we have external collaborators, the GIT/SVN servers are in the DMZ. Individual collaborators are given credentials for the GIT/SVN servers (but not for the internal network / VPN).
I would like to move the GIT/SVN servers out of the DMZ in order to reduce their exposure. But external collaborators will still need access. How can I do this?
The only idea I've had, and I don't quite know how to express it or if it's possible, is to move the GIT/SVN server to a separate internal network segment, and give collaborators VPN accounts that are limited to that network segment. Would this work? Other ideas?