Add initial Gitea deployment and setup evidence

docker/gitea/README.md

@@ -0,0 +1,55 @@
+# Inviscid Gitea foundation
+
+This is the temporary, Gitea-only deployment while Student Pack registration is pending.
+The official image version is pinned; verify that it pulls before starting the service.
+SQLite is `/data/gitea/gitea.db`; repositories and other application data share the
+persistent named volume `inviscid_gitea_data`. Container replacement must preserve it.
+Never run `docker compose down --volumes` against the working service.
+
+Only EC2 loopback port 3000 is published. Initial browser access uses an SSH tunnel.
+The existing Color Buttons container remains unchanged on port 80.
+No public backend or Git SSH firewall rule is needed.
+
+From this directory on EC2:
+
+```sh
+sudo docker compose config --quiet
+sudo docker compose pull
+sudo docker compose up -d
+sudo docker compose ps
+```
+
+This initial configuration is NOT the final hostname-based HTTPS deployment.
+After domain registration, replace DOMAIN and ROOT_URL with the actual hostname
+and HTTPS URL. Payton can attach Caddy to `inviscid_services` and forward to
+`gitea:3000`, publish the proxy web ports, persist certificate state, and resolve
+the existing website's port-80 mapping. Remove the loopback mapping if no longer needed.
+
+Self-registration is disabled. Create the initial administrator through the installer;
+create Payton's separate account using administration after initialization.
+Keep passwords, app.ini, database files, and volume contents out of Git and screenshots.
+
+Sources:
+- https://docs.gitea.com/installation/install-with-docker/
+- https://docs.gitea.com/administration/config-cheat-sheet/
+
+## Recorded deployment (October 12, 2026)
+
+- EC2: `ssw590-group-web`, `i-025a57432604c8d4b`, us-east-1.
+- Current public Elastic IP: `100.49.80.94` (replaces `54.221.175.174`).
+- Remote configuration directory: `/home/ubuntu/gitea`.
+- Observed image digest: `docker.gitea.com/gitea@sha256:f505a0d3a41323b786e05942fc7a4075e07ae7c169fd9485649aa55ee543a21a`.
+- Gitea initialized with site title Inviscid; victor is administrator and payton is a regular user.
+- Local HTTP check returned 200; named-volume mount and SQLite file were verified.
+- Both containers remained running following Elastic IP association.
+- Domain registration, public HTTPS, renewal verification, external firewall checks,
+  container-replacement persistence test, and team PR workflow remain incomplete.
+
+For private browser access, use your own authorized key:
+
+```sh
+ssh -i /path/to/your-private-key -o ExitOnForwardFailure=yes -N -L 127.0.0.1:3000:127.0.0.1:3000 ubuntu@100.49.80.94
+```
+
+Open http://localhost:3000 while the tunnel stays open. Each team member must
+have their public key authorized and their source IP allowed for administrative SSH.

docker/gitea/compose.yaml

@@ -0,0 +1,31 @@
+name: inviscid
+
+services:
+  gitea:
+    image: docker.gitea.com/gitea:28.1.0
+    restart: unless-stopped
+    environment:
+      USER_UID: "1000"
+      USER_GID: "1000"
+      GITEA__database__DB_TYPE: sqlite3
+      GITEA__database__PATH: /data/gitea/gitea.db
+      # Temporary URLs for SSH-tunnel initialization; replace after registration.
+      GITEA__server__DOMAIN: localhost
+      GITEA__server__ROOT_URL: http://localhost:3000/
+      GITEA__server__HTTP_PORT: "3000"
+      GITEA__server__DISABLE_SSH: "true"
+      GITEA__service__DISABLE_REGISTRATION: "true"
+    ports:
+      - "127.0.0.1:3000:3000"
+    volumes:
+      - gitea_data:/data
+    networks:
+      - services
+
+volumes:
+  gitea_data:
+    name: inviscid_gitea_data
+
+networks:
+  services:
+    name: inviscid_services