diff --git a/backmatter/devopsAIPromptLog.tex b/backmatter/devopsAIPromptLog.tex index 629c668..d01d583 100644 --- a/backmatter/devopsAIPromptLog.tex +++ b/backmatter/devopsAIPromptLog.tex @@ -179,3 +179,20 @@ and contact details was excluded from the repository; free-checkout and domain management screenshots provide non-sensitive evidence instead. Public HTTPS, renewal tests, external exposure, persistence replacement, Payton's PR review, merge/closure, remaining issues/README, and final compilation are not claimed. + +\subsection{Record 10 --- HTTPS, Firewall, Persistence, and Report Completion} +\textbf{Date:} October 13--15, 2026.\\ +\textbf{Tool and model:} Anthropic Claude (Opus 5.5).\\ +\textbf{Task:} Plan Payton's remaining Chapter~2 work; guide security-group +changes, Caddy and Compose configuration, the renewal, persistence, and +external exposure tests; draft README edits, the architecture diagram, +and this chapter's completed sections.\\ +\textbf{Human actions:} Payton ran every console action and command, captured +all screenshots, chose Caddy, wrote and edited the issues, opened and merged +PR 7, and reviewed PR 2. Victor reviewed PR 7. The assistant viewed the AWS +console read-only; it made no AWS, DNS, or Gitea changes.\\ +\textbf{Output used:} Configuration (Caddyfile, Compose additions), README +edits, TikZ diagram, and chapter text based on Payton's screenshots and +command output.\\ +\textbf{Evidence handling and limits:} Values in this chapter come from the +saved screenshots. Team IP addresses are redacted in the text. diff --git a/backmatter/glossary.tex b/backmatter/glossary.tex index e527442..1f3c1e3 100644 --- a/backmatter/glossary.tex +++ b/backmatter/glossary.tex @@ -2,7 +2,9 @@ \newacronym{ami}{AMI}{Amazon Machine Image} \newacronym{iam}{IAM}{identity and access management} \newacronym{mfa}{MFA}{multi-factor authentication} +\newacronym{acme}{ACME}{Automatic Certificate Management Environment} \newacronym{ssh}{SSH}{secure shell} +\newacronym{tls}{TLS}{Transport Layer Security} \newacronym{wip}{WIP}{work in progress} \newacronym{wsl}{WSL}{Windows Subsystem for Linux} \newglossaryentry{evidence}{name={evidence},description={A retained record of an @@ -14,6 +16,8 @@ \newglossaryentry{texlive}{name={TeX Live},description={A cross-platform distribution of the \TeX\ engines, \LaTeX\ packages, fonts, and tools; the distribution Overleaf compiles with}} +\newglossaryentry{caddy}{name={Caddy},description={A web server and reverse +proxy that obtains and renews TLS certificates automatically; the team's HTTPS endpoint for Gitea}} \newglossaryentry{sqlite}{name={SQLite},description={An embedded database stored in a local file; Gitea's selected database for the initial two-person deployment}} \newglossaryentry{elasticip}{name={Elastic IP},description={An allocated AWS diff --git a/chapters/devopsCloudDockerDeployment.tex b/chapters/devopsCloudDockerDeployment.tex index 476512c..1b4cb4d 100644 --- a/chapters/devopsCloudDockerDeployment.tex +++ b/chapters/devopsCloudDockerDeployment.tex @@ -117,6 +117,8 @@ curl -I http://127.0.0.1 The create command assumes the container name is unused. The restart policy allows the running service to resume after a host restart. The application binds to all container interfaces, and the AWS security group permits public HTTP. +Since October 15, 2026, the container no longer publishes port 80; Caddy serves +it by IP over the private Docker network (\ChapterRef{GiteaFoundation}). \section{Verification Evidence} The terminal screenshot shows container \texttt{70ed56f7fae8} running, the diff --git a/chapters/devopsHosts.tex b/chapters/devopsHosts.tex index ad5b14f..198943e 100644 --- a/chapters/devopsHosts.tex +++ b/chapters/devopsHosts.tex @@ -36,7 +36,7 @@ only once it exists and is reachable. \multicolumn{4}{l}{\small\itshape Host Inventory (continued)}\\ \toprule \textbf{Host name} & \textbf{Role} & \textbf{Platform} & \textbf{Status}\\ \midrule \endhead \bottomrule \endlastfoot -\texttt{ssw590-group-web} & Group deployment target. Runs Color Buttons and the Gitea work hub in \ChapterRef{GiteaFoundation}; Elastic IP \texttt{100.49.80.94}; DNS \texttt{git.inviscid.dev} verified October 15 (HTTPS pending). & Ubuntu 26.04 LTS on Amazon EC2, \texttt{t3.micro} & In service\\ +\texttt{ssw590-group-web} & Group deployment target. Runs Color Buttons and the Gitea work hub in \ChapterRef{GiteaFoundation}; Elastic IP \texttt{100.49.80.94}; DNS \texttt{git.inviscid.dev}; HTTPS through Caddy. & Ubuntu 26.04 LTS on Amazon EC2, \texttt{t3.micro} & In service\\ \texttt{ssw590-dev-01} & Primary Linux host for the course. Target for service configuration, deployment exercises, and command-line work. & Ubuntu Server LTS on Amazon EC2 & Planned\\ \end{tabularx} diff --git a/chapters/devopsIntroduction.tex b/chapters/devopsIntroduction.tex index 914ff88..912ee01 100644 --- a/chapters/devopsIntroduction.tex +++ b/chapters/devopsIntroduction.tex @@ -10,8 +10,8 @@ This document records the configuration of the development environment used for \CourseNumber\ and the working practices followed to produce it. Each chapter covers one subject, and each assignment adds or revises chapters as recorded in the document history. The latest revision for Assignment~\AssignmentNumber\ -adds \ChapterRef{GiteaFoundation}, recording the initial Gitea deployment -and the pending checks required to complete the assignment. +adds \ChapterRef{GiteaFoundation}, recording the Gitea deployment, HTTPS, firewall, +persistence testing, and team workflow. Earlier coursework chapters are retained. \section{Scope and Constraints} @@ -63,7 +63,7 @@ the Template Attribution page. The template's instructional example chapter and its template-maintenance appendices have been removed, since they describe how to author the template rather than the environment this document records. -\ChapterRef{GiteaFoundation} records the persistent work hub, team access, and pending domain, HTTPS, and workflow evidence. +\ChapterRef{GiteaFoundation} records the persistent work hub, domain and DNS, HTTPS, firewall, persistence testing, and team workflow. \section{Tools and AI Assistance} \index{AI assistance} diff --git a/chapters/devopsPasswords.tex b/chapters/devopsPasswords.tex index b34623f..b99b897 100644 --- a/chapters/devopsPasswords.tex +++ b/chapters/devopsPasswords.tex @@ -44,7 +44,7 @@ only where a generated secret cannot be retrieved. \endhead \bottomrule \endlastfoot Victor & Name.com registrar & Private account & Domain inviscid.dev; credentials held outside Git/report. Victor manages renewal; auto-renewal enabled.\\ \texttt{victor} & Gitea (Inviscid) & Unique & Site administrator; password kept outside this report and repository.\\ -\texttt{payton} & Gitea (Inviscid) & Temporary & Initial password delivered separately; mandatory change configured. Successful login reported; password-change completion not separately evidenced.\\ +\texttt{payton} & Gitea (Inviscid) & Unique & Temporary password changed by Payton after first login; new password kept outside this report and repository.\\ Both authors & EC2 \texttt{ubuntu} & SSH key & Separate private keys remain on each author's workstation; only public keys authorized on EC2. No private keys in Git.\\ \texttt{root} & \texttt{ssw590-dev-01} & None & No password. Administrative access is obtained through \texttt{sudo} by a named account, so that privileged actions are attributable.\\ \texttt{payton} & \texttt{ssw590-dev-01}, \texttt{ssw590-build-01} & Derived & Used only to authenticate \texttt{sudo}; \gls{ssh} password authentication is disabled, so this secret never crosses the network. diff --git a/devopsAssignment.tex b/devopsAssignment.tex index 4a574bb..2c43289 100644 --- a/devopsAssignment.tex +++ b/devopsAssignment.tex @@ -42,7 +42,7 @@ % Replace these values for each assignment. \newcommand{\AssignmentTitle}{Startup Foundation with Gitea} \newcommand{\AssignmentNumber}{4} -\newcommand{\DocumentVersion}{4.1} +\newcommand{\DocumentVersion}{4.2} \newcommand{\DocumentStatus}{Submitted Document} \newcommand{\CourseNumber}{SSW 590} \newcommand{\CourseName}{DevOps} diff --git a/figures/gitea/afterissue.png b/figures/gitea/afterissue.png new file mode 100644 index 0000000..d6e908b Binary files /dev/null and b/figures/gitea/afterissue.png differ diff --git a/figures/gitea/beforeissue.png b/figures/gitea/beforeissue.png new file mode 100644 index 0000000..1869ecd Binary files /dev/null and b/figures/gitea/beforeissue.png differ diff --git a/figures/gitea/caddy.png b/figures/gitea/caddy.png new file mode 100644 index 0000000..df088fa Binary files /dev/null and b/figures/gitea/caddy.png differ diff --git a/figures/gitea/container-startup.png b/figures/gitea/container-startup.png deleted file mode 100644 index 4db0215..0000000 Binary files a/figures/gitea/container-startup.png and /dev/null differ diff --git a/figures/gitea/containers-after-ip-change.png b/figures/gitea/containers-after-ip-change.png deleted file mode 100644 index b7b8a50..0000000 Binary files a/figures/gitea/containers-after-ip-change.png and /dev/null differ diff --git a/figures/gitea/documentation-branch-push.png b/figures/gitea/documentation-branch-push.png deleted file mode 100644 index fd272d3..0000000 Binary files a/figures/gitea/documentation-branch-push.png and /dev/null differ diff --git a/figures/gitea/ec2-summary.png b/figures/gitea/ec2-summary.png deleted file mode 100644 index 071f1c9..0000000 Binary files a/figures/gitea/ec2-summary.png and /dev/null differ diff --git a/figures/gitea/elastic-ip-association.png b/figures/gitea/elastic-ip-association.png deleted file mode 100644 index 5e25e28..0000000 Binary files a/figures/gitea/elastic-ip-association.png and /dev/null differ diff --git a/figures/gitea/gitea-through-tunnel.png b/figures/gitea/gitea-through-tunnel.png deleted file mode 100644 index a2a245a..0000000 Binary files a/figures/gitea/gitea-through-tunnel.png and /dev/null differ diff --git a/figures/gitea/http-image-digest.png b/figures/gitea/http-image-digest.png deleted file mode 100644 index e5b0a7b..0000000 Binary files a/figures/gitea/http-image-digest.png and /dev/null differ diff --git a/figures/gitea/initial-login.png b/figures/gitea/initial-login.png deleted file mode 100644 index 28135be..0000000 Binary files a/figures/gitea/initial-login.png and /dev/null differ diff --git a/figures/gitea/installer-settings.png b/figures/gitea/installer-settings.png deleted file mode 100644 index f597dcf..0000000 Binary files a/figures/gitea/installer-settings.png and /dev/null differ diff --git a/figures/gitea/issue-1-documentation.png b/figures/gitea/issue-1-documentation.png deleted file mode 100644 index 284ad05..0000000 Binary files a/figures/gitea/issue-1-documentation.png and /dev/null differ diff --git a/figures/gitea/laptop.png b/figures/gitea/laptop.png new file mode 100644 index 0000000..428a098 Binary files /dev/null and b/figures/gitea/laptop.png differ diff --git a/figures/gitea/member-accounts.png b/figures/gitea/member-accounts.png deleted file mode 100644 index 7bd23d5..0000000 Binary files a/figures/gitea/member-accounts.png and /dev/null differ diff --git a/figures/gitea/mypr.png b/figures/gitea/mypr.png new file mode 100644 index 0000000..953bee6 Binary files /dev/null and b/figures/gitea/mypr.png differ diff --git a/figures/gitea/payton-key-authorized.png b/figures/gitea/payton-key-authorized.png deleted file mode 100644 index 6c9ccb9..0000000 Binary files a/figures/gitea/payton-key-authorized.png and /dev/null differ diff --git a/figures/gitea/persistencetest.png b/figures/gitea/persistencetest.png new file mode 100644 index 0000000..472b950 Binary files /dev/null and b/figures/gitea/persistencetest.png differ diff --git a/figures/gitea/ports.png b/figures/gitea/ports.png new file mode 100644 index 0000000..75e787c Binary files /dev/null and b/figures/gitea/ports.png differ diff --git a/figures/gitea/pr-2-chapter-diff.png b/figures/gitea/pr-2-chapter-diff.png deleted file mode 100644 index c2eb760..0000000 Binary files a/figures/gitea/pr-2-chapter-diff.png and /dev/null differ diff --git a/figures/gitea/pr-2-review-request.png b/figures/gitea/pr-2-review-request.png deleted file mode 100644 index 1f123a8..0000000 Binary files a/figures/gitea/pr-2-review-request.png and /dev/null differ diff --git a/figures/gitea/pr2merge.png b/figures/gitea/pr2merge.png new file mode 100644 index 0000000..629e10f Binary files /dev/null and b/figures/gitea/pr2merge.png differ diff --git a/figures/gitea/readme.png b/figures/gitea/readme.png new file mode 100644 index 0000000..bcf5431 Binary files /dev/null and b/figures/gitea/readme.png differ diff --git a/figures/gitea/repository-main-import.png b/figures/gitea/repository-main-import.png deleted file mode 100644 index eeff9a1..0000000 Binary files a/figures/gitea/repository-main-import.png and /dev/null differ diff --git a/figures/gitea/security-group-team-access.png b/figures/gitea/security-group-team-access.png deleted file mode 100644 index 8e2c994..0000000 Binary files a/figures/gitea/security-group-team-access.png and /dev/null differ diff --git a/figures/gitea/security.png b/figures/gitea/security.png new file mode 100644 index 0000000..8a8ac80 Binary files /dev/null and b/figures/gitea/security.png differ diff --git a/figures/gitea/server-preflight.png b/figures/gitea/server-preflight.png deleted file mode 100644 index b83cff1..0000000 Binary files a/figures/gitea/server-preflight.png and /dev/null differ diff --git a/figures/gitea/ssh-tunnel-elastic-ip.png b/figures/gitea/ssh-tunnel-elastic-ip.png deleted file mode 100644 index ee633c4..0000000 Binary files a/figures/gitea/ssh-tunnel-elastic-ip.png and /dev/null differ diff --git a/figures/gitea/storage-resources.png b/figures/gitea/storage-resources.png deleted file mode 100644 index 6112c4a..0000000 Binary files a/figures/gitea/storage-resources.png and /dev/null differ diff --git a/figures/gitea/student-pack-approved-awaiting-benefits.png b/figures/gitea/student-pack-approved-awaiting-benefits.png deleted file mode 100644 index 199c397..0000000 Binary files a/figures/gitea/student-pack-approved-awaiting-benefits.png and /dev/null differ diff --git a/figures/gitea/student-pack-domain-offer.png b/figures/gitea/student-pack-domain-offer.png deleted file mode 100644 index 1d5706d..0000000 Binary files a/figures/gitea/student-pack-domain-offer.png and /dev/null differ diff --git a/figures/gitea/student-pack-pending.png b/figures/gitea/student-pack-pending.png deleted file mode 100644 index 02394f8..0000000 Binary files a/figures/gitea/student-pack-pending.png and /dev/null differ diff --git a/figures/gitea/subnets.png b/figures/gitea/subnets.png new file mode 100644 index 0000000..79e2160 Binary files /dev/null and b/figures/gitea/subnets.png differ diff --git a/frontmatter/abstract.tex b/frontmatter/abstract.tex index 8b6b60e..95c5f76 100644 --- a/frontmatter/abstract.tex +++ b/frontmatter/abstract.tex @@ -14,6 +14,7 @@ Assignment 4 records the persistent Gitea service on the existing EC2 host, Elastic IP association, and separate team access. It also records Student Pack domain redemption, inviscid.dev registration and independently verified DNS, organization ownership, repository import, and the first open issue-linked PR. -Public HTTPS, renewal and external exposure tests, container-replacement -persistence verification, and both completed reviewed-merge workflows remain -pending in this draft. +It also records Caddy-terminated HTTPS with a Let's Encrypt certificate and +renewal test, the EC2 security group with external exposure tests, a +container-replacement persistence test, the product backlog, and two reviewed, +issue-linked pull requests. diff --git a/frontmatter/devopsDocumentHistory.tex b/frontmatter/devopsDocumentHistory.tex index a6c2e26..a286a24 100644 --- a/frontmatter/devopsDocumentHistory.tex +++ b/frontmatter/devopsDocumentHistory.tex @@ -11,6 +11,7 @@ link each entry to the changed chapter, table, figure, or controlled artifact. \multicolumn{4}{l}{\small\itshape Document Update History (continued)}\\ \toprule \textbf{Date / Version} & \textbf{Author Initials} & \textbf{Change} & \textbf{Changed At}\\ \midrule \endhead \bottomrule \endlastfoot +October 15, 2026 / 4.2 & PCB & Added Caddy HTTPS with certificate, redirect, and forced-reissue renewal evidence; certificate-option comparison; security-group, network ACL, port-mapping, and external exposure tests; the container-replacement persistence test; architecture diagram and operations notes; issues 3--6 and reviewed PR 7. Updated the Hosts entry (HTTPS verified), Payton's Passwords hint, abstract, introduction, Cloud Docker note, glossary, and AI log. & \ChapterRef{GiteaFoundation}, \ChapterRef{Hosts}, \ChapterRef{Passwords}, \ChapterRef{CloudDockerDeployment}, \ChapterRef{AIPromptLog}\\ October 15, 2026 / 4.1 & VDRF & Recorded Student Pack redemption, inviscid.dev registration/renewal, DNS record and two independent lookups, organization ownership, repository import, issue 1, and open PR 2. Updated Hosts domain entry, Passwords registrar/account hints, abstract, AI log, and deployment handoff notes; HTTPS and reviewed merges remain pending. & \ChapterRef{GiteaFoundation}, \ChapterRef{Hosts}, \ChapterRef{Passwords}, \ChapterRef{AIPromptLog}\\ October 15, 2026 / 4.0 & VDRF & Added the initial Gitea foundation chapter with deployment, SQLite, Elastic IP, access evidence, and explicit pending DNS/HTTPS/workflow items. Updated Hosts inventory and cleanup, Passwords account/hint table and policy-versus-observation wording, metadata, abstract, introduction, and AI log. & \ChapterRef{GiteaFoundation}, \ChapterRef{Hosts}, \ChapterRef{Passwords}, \ChapterRef{AIPromptLog}\\ October 6, 2026 / 3.2 & VDRF & Replaced the preliminary tool proposal with Inviscid, its sample customer task, tentative stack, research question, and independent SWOT assessments of Prometheus and VictoriaMetrics. Updated the abstract and AI log. & \ChapterRef{ProjectProposal}, \ChapterRef{AIPromptLog}\\