On Windows, you can also serve Git repositories with Apache over HTTP or HTTPS, using the DAV extension.
The Git repository path can then be protected with Apache authentication checks such as restricting to certain IP addresses or htpasswd/htdigest type authentication.
The limitation of using htpasswd/htdigest authentication is that the username:password is passed in the requested Git URL, so restricting access to the Git URL to certain IP addresses is better.
Edit: Note, you can leave the password out of the Git URL and Git will prompt you for the password on push and fetch/pull instead.
Using HTTPS means all the data is encrypted in transfer.
It's easy enough to set up, and works.
The following example shows the combination of access control by IP address and user:password over standard HTTP.
Example Apache Virtualhost
## GIT HTTP DAV ##
<VirtualHost *:80>
ServerName git.example.com
DocumentRoot C:\webroot\htdocs\restricted\git
ErrorLog C:\webroot\apache\logs\error-git-webdav.log
<Location />
DAV on
# Restrict Access
AuthType Basic
AuthName "Restricted Area"
AuthUserFile "C:\webroot\apache\conf\git-htpasswd"
# To valid user
Require valid-user
# AND valid IP address
Order Deny,Allow
Deny from all
# Example IP 1
Allow from 203.22.56.67
# Example IP 2
Allow from 202.12.33.44
# Require both authentication checks to be satisfied
Satisfy all
</Location>
</VirtualHost>
Example .git/config
[core]
repositoryformatversion = 0
filemode = true
bare = false
logallrefupdates = true
[remote "origin"]
fetch = +refs/heads/*:refs/remotes/origin/*
url = http://username:password@git.example.com/codebase.git
[branch "master"]
remote = origin
merge = refs/heads/master