You can get CVS to work over any form of tunneling, and yes there are web interfaces, I dont have the time to search for them right now, but will get back to you.
Over ssh:
Code:
~ > setenv CVS_RSH ssh
~ > setenv CVSROOT your-domain.com:/var/CVSROOT
~ > cvs commit what_ever
I have been fidling with getting cvs working over ssh without a valid login shell, but havn't accomplished it yet, the next best thing, is to provide a chroot jail on the account, this however requires some patching of ssh.