Inviscid/SSW590-DevOps
2
0 Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Add repo README, update Gitea README, add Caddy HTTPS proxy

Browse Source
This commit is contained in:
Payton Bates committed 2026-10-15 20:47:31 -04:00
1 parent aeba4fe443
commit 0cd8561d44
4 files changed
+110 -46
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docker/gitea/Caddyfile
+7
View File
@@ -0,0 +1,7 @@
git.inviscid.dev {
reverse_proxy gitea:3000
}
http://100.49.80.94, http://ec2-100-49-80-94.compute-1.amazonaws.com {
reverse_proxy ssw590-group-buttons:3000
}
docker/gitea/README.md
+24 -43
View File
@@ -1,13 +1,16 @@
# Inviscid Gitea foundation
This is the temporary, Gitea-only deployment used before the domain was registered; retain it as the initial deployment configuration.
The official image version is pinned; verify that it pulls before starting the service.
This directory deploys Gitea at https://git.inviscid.dev/ behind a Caddy reverse proxy.
The official image version is pinned.
SQLite is `/data/gitea/gitea.db`; repositories and other application data share the
persistent named volume `inviscid_gitea_data`. Container replacement must preserve it.
persistent named volume `inviscid_gitea_data`.
Never run `docker compose down --volumes` against the working service.
Only EC2 loopback port 3000 is published. Initial browser access uses an SSH tunnel.
The existing Color Buttons container remains unchanged on port 80.
Only Caddy publishes host ports (80 and 443). Caddy terminates TLS and forwards to
`gitea:3000` over the private `inviscid_services` network. Gitea's port 3000 is also
bound to EC2 loopback only, for SSH-tunnel administration.
The Color Buttons container (`ssw590-group-buttons`) no longer publishes port 80; it
runs on `inviscid_services` and Caddy serves it at http://100.49.80.94.
No public backend or Git SSH firewall rule is needed.
From this directory on EC2:
@@ -19,30 +22,18 @@ sudo docker compose up -d
sudo docker compose ps
```
This initial configuration is NOT the final hostname-based HTTPS deployment.
After domain registration, replace DOMAIN and ROOT_URL with the actual hostname
and HTTPS URL. Payton can attach Caddy to `inviscid_services` and forward to
`gitea:3000`, publish the proxy web ports, persist certificate state, and resolve
the existing website's port-80 mapping. Remove the loopback mapping if no longer needed.
`Caddyfile` must be in this directory before `up`; if it is missing, Docker creates a
directory in its place and Caddy fails to start. Caddy obtains and renews the
Let's Encrypt certificate automatically; certificate state persists in the
`inviscid_caddy_data` and `inviscid_caddy_config` volumes.
Self-registration is disabled. Create the initial administrator through the installer;
create Payton's separate account using administration after initialization.
Keep passwords, app.ini, database files, and volume contents out of Git and screenshots.
The Color Buttons container is managed outside Compose. To recreate it without a
published port:
Sources:
- https://docs.gitea.com/installation/install-with-docker/
- https://docs.gitea.com/administration/config-cheat-sheet/
## Recorded deployment (October 12, 2026)
- EC2: `ssw590-group-web`, `i-025a57432604c8d4b`, us-east-1.
- Current public Elastic IP: `100.49.80.94` (replaces `54.221.175.174`).
- Remote configuration directory: `/home/ubuntu/gitea`.
- Observed image digest: `docker.gitea.com/gitea@sha256:f505a0d3a41323b786e05942fc7a4075e07ae7c169fd9485649aa55ee543a21a`.
- Gitea initialized with site title Inviscid; victor is administrator and payton is a regular user.
- Local HTTP check returned 200; named-volume mount and SQLite file were verified.
- Both containers remained running following Elastic IP association.
- This October 12 configuration predates domain registration; see the October 15 update below.
```sh
sudo docker run -d --name ssw590-group-buttons --restart unless-stopped \
--network inviscid_services ssw590-group-buttons
```
For private browser access, use your own authorized key:
@@ -53,20 +44,10 @@ ssh -i /path/to/your-private-key -o ExitOnForwardFailure=yes -N -L 127.0.0.1:300
Open http://localhost:3000 while the tunnel stays open. Each team member must
have their public key authorized and their source IP allowed for administrative SSH.
## October 15 handoff update
Keep passwords, app.ini, database files, and volume contents out of Git and screenshots.
- Student Pack domain offer redeemed: `inviscid.dev`, Name.com, one year at $0.00.
- Displayed renewal: October 15, 2027 at $22.99; auto-renew enabled. Victor owns renewal.
- Saved A record: `git.inviscid.dev` -> `100.49.80.94`, TTL 300.
- Windows lookups via 1.1.1.1 and 8.8.8.8 both returned that IP at 19:17 EDT.
- Both users are organization owners of `Inviscid`; Payton's SSH/Gitea access works per Victor.
- Existing main history pushed to `Inviscid/SSW590-DevOps`; issue #1 and PR #2 created.
- PR #2 (`da6a369`, `codex/gitea-foundation-docs`) awaits Payton's review and merge.
- Payton owns the remaining Gitea tasks; Victor will review his separate PR.
- Public HTTPS, renewal tests, external exposure, container replacement persistence,
README/five-issue completion, and two completed reviewed PR workflows are not yet verified.
Payton: update DOMAIN to `git.inviscid.dev` and ROOT_URL to
`https://git.inviscid.dev/` alongside Caddy configuration. The tracked Compose
file still intentionally records the initial localhost setup; do not interpret
the new DNS record as proof that HTTPS has been deployed.
Sources:
- https://docs.gitea.com/installation/install-with-docker/
- https://docs.gitea.com/administration/config-cheat-sheet/
- https://caddyserver.com/docs/running#docker-compose
- https://caddyserver.com/docs/automatic-https
docker/gitea/compose.yaml
+21 -3
View File
@@ -9,9 +9,8 @@ services:
USER_GID: "1000"
GITEA__database__DB_TYPE: sqlite3
GITEA__database__PATH: /data/gitea/gitea.db
# Temporary URLs for SSH-tunnel initialization; replace after registration.
GITEA__server__DOMAIN: localhost
GITEA__server__ROOT_URL: http://localhost:3000/
GITEA__server__DOMAIN: git.inviscid.dev
GITEA__server__ROOT_URL: https://git.inviscid.dev/
GITEA__server__HTTP_PORT: "3000"
GITEA__server__DISABLE_SSH: "true"
GITEA__service__DISABLE_REGISTRATION: "true"
@@ -22,9 +21,28 @@ services:
networks:
- services
caddy:
image: caddy:2.10.2
restart: unless-stopped
ports:
- "80:80"
- "443:443"
volumes:
- ./Caddyfile:/etc/caddy/Caddyfile:ro
- caddy_data:/data
- caddy_config:/config
networks:
- services
depends_on:
- gitea
volumes:
gitea_data:
name: inviscid_gitea_data
caddy_data:
name: inviscid_caddy_data
caddy_config:
name: inviscid_caddy_config
networks:
services: