Merge pull request #1 from byterand/codex/gitea-foundation-docs

Codex/gitea foundation docs

backmatter/devopsAIPromptLog.tex

@@ -139,3 +139,43 @@ explicitly marked undecided.\\
 pipeline remain proposed work. No performance results or completed monitoring
 features are claimed. The combined report still requires final author review
 and compilation before submission.
+
+
+\subsection{Record 8 --- Gitea Foundation and Evidence Draft}
+\textbf{Dates:} October 12--15, 2026.\\
+\textbf{Tool:} OpenAI Codex.\\
+\textbf{Task:} Guide Victor through Student Pack application, Docker/SQLite
+Gitea setup, SSH tunneling, Elastic IP association, and Payton's key access;
+prepare the pre-PR documentation from supplied execution evidence.\\
+\textbf{Human contribution:} Victor operated the consoles and terminals,
+created accounts, supplied screenshots, and reported Payton's successful SSH
+connection. Payton's remaining work was not executed by the assistant.\\
+\textbf{Output used:} Non-secret Compose configuration, deployment notes,
+saved screenshots, Gitea chapter draft, and matching inventory, account-hint,
+history, and metadata updates.\\
+\textbf{Corrections and limits:} Documented benefit activation separately from
+academic approval; recorded the current Elastic IP and the unresolved campus
+SSH timeout; did not infer public HTTPS or persistence replacement success
+from local checks. Domain details, renewal and external checks, PR workflows,
+final compilation, and submission remain unverified.
+
+
+\subsection{Record 9 --- Domain, DNS, and Open PR Evidence}
+\textbf{Date:} October 15, 2026.\\
+\textbf{Tool:} OpenAI Codex.\\
+\textbf{Task:} Guide Victor through organization/repository setup, issue-linked
+PR creation, Name.com Student Pack domain redemption, and independent DNS
+verification; document all completed work and its evidence.\\
+\textbf{Human actions:} Victor created the Inviscid organization, assigned both
+authors to Owners, pushed the existing main history, created issue 1, committed
+and pushed documentation, and opened PR 2 requesting Payton's review. Victor
+reported successful Overleaf compilation/review of the earlier draft and
+Payton's working SSH/Gitea access. Victor registered inviscid.dev and executed
+the supplied DNS lookups; the assistant did not perform purchases or DNS writes.\\
+\textbf{Output used:} Procedural guidance, saved non-secret screenshots,
+updated chapter, renewal/account records, and explicit handoff/pending status.\\
+\textbf{Evidence handling and limits:} The order screenshot containing billing
+and contact details was excluded from the repository; free-checkout and domain
+management screenshots provide non-sensitive evidence instead. Public HTTPS,
+renewal tests, external exposure, persistence replacement, Payton's PR review,
+merge/closure, remaining issues/README, and final compilation are not claimed.

backmatter/glossary.tex

@@ -13,4 +13,8 @@
   represents each unit of work as a card in a column denoting its state}}
 \newglossaryentry{texlive}{name={TeX Live},description={A cross-platform
   distribution of the \TeX\ engines, \LaTeX\ packages, fonts, and tools; the
-  distribution Overleaf compiles with}}
+  distribution Overleaf compiles with}}
+\newglossaryentry{sqlite}{name={SQLite},description={An embedded database stored
+in a local file; Gitea's selected database for the initial two-person deployment}}
+\newglossaryentry{elasticip}{name={Elastic IP},description={An allocated AWS
+public IPv4 address that can remain associated with the deployment across instance restarts}}

chapters/devopsGiteaFoundation.tex

@@ -0,0 +1,438 @@
+\chapter{Startup Foundation with Gitea}
+\ChapterLabel{GiteaFoundation}
+\index{Gitea}\index{SQLite}\index{Docker Compose}\index{Elastic IP}\index{SSH tunnel}
+
+This chapter records the initial Inviscid work hub on the existing Amazon EC2
+server. AWS is used in place of the assignment's DigitalOcean deployment.
+The dated screenshots record completed work; pending items below are not
+represented as passed. This draft covers Victor's deployment and access setup.
+
+\section{Student Pack Domain and DNS}
+Victor submitted current school-enrollment evidence to GitHub Education on
+October 12, 2026. Academic status was approved that day, while partner benefits
+remained in ``Awaiting Benefits'' status with a stated 72-hour activation delay
+(Figure~\ref{Figure:GiteaBenefits}). On October 15 the benefits became available,
+and Victor redeemed Name.com's GitHub Student Developer Pack offer.
+
+The offer covered selected extensions rather than the preferred
+\texttt{inviscid.net}. Victor selected \texttt{inviscid.dev}, registered it for
+one year, and supplied the completed order and domain-management evidence.
+The checkout total was \$0.00, with the free Domain Safe option; Domain Safe Pro
+and optional hosting/email upgrades were not selected. No registrar-provided
+SSL product is needed for the planned Caddy deployment.
+
+\begin{tabularx}{\linewidth}{L{3.8cm}Y}
+\caption{Student Domain and DNS Record\label{Table:GiteaDomain}}\\
+\toprule \textbf{Field} & \textbf{Recorded value}\\ \midrule
+Provider and eligibility & Name.com, redeemed through the activated GitHub Student Developer Pack benefit\\
+Registered domain & \texttt{inviscid.dev}\\
+Registration date / term & October 15, 2026 / one year\\
+Initial charge & \$0.00\\
+Displayed renewal price & \$22.99; verify current price before renewal\\
+Displayed renewal date & October 15, 2027\\
+Account owner / renewal responsibility & Victor; keep payment/contact details current and track renewal before the anniversary\\
+Renewal and protection settings & Automatic renewal ON; WHOIS privacy ON; transfer lock enabled\\
+Gitea hostname & \texttt{git.inviscid.dev}\\
+DNS hosting & Name.com's DNS management; exact authoritative nameserver values not yet captured\\
+DNS record & A, host \texttt{git}, answer \texttt{100.49.80.94}, TTL 300 seconds\\
+Intended public service URL & \url{https://git.inviscid.dev/}; DNS verified, HTTPS still pending in this record\\
+\bottomrule
+\end{tabularx}
+
+Victor manages registration and renewal; the registrar's automatic-renewal
+setting and October 2027 anniversary provide the recorded renewal controls.
+Domain registration and DNS are independent of the class AWS account hosting
+the application. Prices can change, so the table records the displayed price,
+not a guarantee of the eventual renewal charge.
+
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/student-pack-approved-awaiting-benefits.png}
+\caption{October 12: academic approval preceded partner-benefit activation. The delay was resolved before domain registration on October 15.}
+\label{Figure:GiteaBenefits}
+\end{figure}
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=0.62\linewidth,height=0.60\textheight,keepaspectratio]{figures/gitea/student-pack-domain-offer.png}
+\caption{October 15: Name.com Student Pack offer for selected domain extensions.}
+\label{Figure:GiteaDomainOffer}
+\end{figure}
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/domain-free-checkout.png}
+\caption{October 15: one-year inviscid.dev registration at a checkout total of zero, with paid Domain Safe Pro unselected.}
+\label{Figure:GiteaDomainCheckout}
+\end{figure}
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/domain-renewal-details.png}
+\caption{October 15: registered domain, October 15, 2027 renewal date, displayed renewal price, auto-renewal, privacy, and transfer-lock settings.}
+\label{Figure:GiteaDomainRenewal}
+\end{figure}
+
+In Name.com's Manage DNS page, Victor added an A record with host
+\texttt{git}; the interface appended \texttt{.inviscid.dev}. The answer is the
+EC2 Elastic IP rather than the old auto-assigned address. The saved record
+and creation date are visible in Figure~\ref{Figure:GiteaDNSRecord}.
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/dns-a-record.png}
+\caption{October 15: saved A record for git.inviscid.dev pointing to 100.49.80.94 with a 300-second TTL.}
+\label{Figure:GiteaDNSRecord}
+\end{figure}
+
+Victor independently verified the record from Windows PowerShell, outside
+EC2, using two public DNS resolvers:
+\begin{minted}{powershell}
+Get-Date -Format o
+Resolve-DnsName git.inviscid.dev -Type A -Server 1.1.1.1
+Resolve-DnsName git.inviscid.dev -Type A -Server 8.8.8.8
+\end{minted}
+The supplied timestamp is October 15, 2026 at 19:17:31, UTC offset -04:00.
+Both resolvers returned an A answer of \texttt{100.49.80.94}, TTL 300.
+This verifies public name resolution, not application availability or TLS.
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/dns-independent-lookups.png}
+\caption{October 15: independent Cloudflare and Google resolver lookups both return the expected Elastic IP.}
+\label{Figure:GiteaDNSLookup}
+\end{figure}
+
+\section{Pinned Gitea Deployment}
+The existing \texttt{ssw590-group-web} instance runs Ubuntu 26.04 LTS on a
+\texttt{t3.micro} in \texttt{us-east-1}. The initial resource check recorded
+908 MiB total memory, 468 MiB available memory, and 3.1 GiB available root disk.
+Docker Compose reported version 5.6.0. The existing Color Buttons container
+continued to serve host port 80 while Gitea was initialized privately.
+
+\begin{tabularx}{\linewidth}{L{3.5cm}Y}
+\caption{Recorded Gitea Deployment\label{Table:GiteaDeployment}}\\
+\toprule \textbf{Setting} & \textbf{Value}\\ \midrule
+Instance & \texttt{i-025a57432604c8d4b}, \texttt{ssw590-group-web}\\
+Current public address & Elastic IP \texttt{100.49.80.94}\\
+Private address & \texttt{172.31.19.91}\\
+Official image & \texttt{docker.gitea.com/gitea:28.1.0}\\
+Container & \texttt{inviscid-gitea-1}\\
+Remote working directory & \path{/home/ubuntu/gitea}\\
+Persistent volume & \texttt{inviscid\_gitea\_data}, mounted at \path{/data}\\
+Docker network & \texttt{inviscid\_services}\\
+Restart policy & \texttt{unless-stopped}\\
+Published backend & \texttt{127.0.0.1:3000:3000}; no public backend mapping\\
+Temporary public URL setting & \url{http://localhost:3000/}; SSH-tunnel access only\\
+\bottomrule
+\end{tabularx}
+
+The official Docker installation guide supports persistent application storage
+and SQLite initialization. We pinned a version rather than using a floating
+\texttt{latest} tag. The recorded repository digest is:
+\begin{minted}[fontsize=\scriptsize]{text}
+docker.gitea.com/gitea@sha256:f505a0d3a41323b786e05942fc7a4075e07ae7c169fd9485649aa55ee543a21a
+\end{minted}
+
+The non-secret configuration is maintained in
+\href{https://github.com/byterand/SSW590-DevOps/tree/main/docker/gitea}{the team's versioned deployment directory}.
+The following file is the initial localhost-only configuration. Its URL settings
+must be updated for the registered HTTPS hostname before final submission.
+\inputminted{yaml}{docker/gitea/compose.yaml}
+
+Victor copied the directory from the Windows workstation to EC2 using
+\texttt{scp}. In the remote directory, he validated, pulled, and started it:
+\begin{minted}{bash}
+cd ~/gitea
+sudo docker compose config --quiet
+sudo docker compose pull
+sudo docker compose up -d
+sudo docker compose ps
+sudo docker compose logs --tail=40 gitea
+\end{minted}
+Validation returned without an error, the pinned image pulled, and Compose
+created the volume, network, and container. Startup logs showed Gitea 28.1.0
+listening internally on port 3000 and preparing its installation page.
+
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/compose-validation-pull.png}
+\caption{October 12: successful Compose validation and pull of the pinned official image.}
+\label{Figure:GiteaPull}
+\end{figure}
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/container-startup.png}
+\caption{October 12: container startup and localhost port mapping. The image exposes an internal SSH port, but no host SSH mapping was published for Gitea.}
+\label{Figure:GiteaStartup}
+\end{figure}
+
+Victor associated the Elastic IP with the same instance, replacing the earlier
+\texttt{54.221.175.174} address. The containers remained running. SSH and tunnel
+commands were updated to use the new address; the data and private address did
+not change.
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/elastic-ip-association.png}
+\caption{October 12: Elastic IP 100.49.80.94 associated with the existing instance.}
+\label{Figure:GiteaElasticIP}
+\end{figure}
+
+\section{Database and Persistence}
+SQLite was selected for the small two-person deployment. It requires no
+separate database service or network port. The database is at
+\path{/data/gitea/gitea.db}, within the same persistent named volume that holds
+application configuration and repository data. The volume exists outside the
+disposable container layer. Generated configuration, database contents, and
+secrets are not stored in the Git repository.
+
+The following checks were executed on October 12:
+\begin{minted}{bash}
+sudo docker inspect inviscid-gitea-1 --format '{{range .Mounts}}{{println .Type .Name .Destination}}{{end}}'
+sudo docker compose exec -T gitea ls -lh /data/gitea/gitea.db
+sudo docker stats --no-stream
+free -h
+df -h /
+\end{minted}
+The mount check showed \texttt{inviscid\_gitea\_data} at \path{/data}; the
+SQLite file existed and was approximately 2.1 MiB. Gitea used approximately
+187 MiB RAM in that snapshot, with 367 MiB system memory and 2.8 GiB disk
+available. These are single observations, not load-test results.
+
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/storage-resources.png}
+\caption{October 12: named-volume mount, database file, and resource checks. These verify storage configuration, not survival of a container replacement.}
+\label{Figure:GiteaStorage}
+\end{figure}
+
+\textbf{Pending---Payton:} record a repository and issue, replace only the
+Gitea container without deleting its volume, and show that both remain usable.
+Include identifiers, exact command, before/after evidence, and conclusion.
+This required test is distinct from the optional backup/restore exercise.
+
+\section{HTTPS and Certificate Renewal}
+\textbf{Pending---Payton:} compare two certificate options and justify one;
+configure Caddy using \texttt{git.inviscid.dev}, persistent certificate state, and
+private forwarding to \texttt{gitea:3000}; update Gitea's domain and public URL;
+record issuer, expiry, redirect, renewal automation, and a successful renewal
+test or dry run. The existing website's host-port-80 mapping must be resolved
+before Caddy publishes that port. Public HTTPS is not claimed in this draft.
+
+Initial access used an SSH tunnel from the workstation:
+\begin{minted}{bash}
+ssh -i /path/to/your-private-key -o ExitOnForwardFailure=yes -N -L 127.0.0.1:3000:127.0.0.1:3000 ubuntu@100.49.80.94
+\end{minted}
+The browser opened \url{http://localhost:3000/}; transport between workstation
+and server was encrypted by SSH, but this is not hostname-based HTTPS and does
+not satisfy the final certificate requirement. Each workstation needs its own
+tunnel. The \texttt{-N} option keeps the connection open without a remote shell.
+
+\section{Firewall and External Exposure}
+The attached AWS security group is \texttt{ssw590-web-sg}, identifier
+\texttt{sg-0a9eb6dcfc906e78b}. The October 15 screenshot records these IPv4 rules:
+\begin{tabularx}{\linewidth}{L{2cm}L{4cm}Y}
+\toprule \textbf{TCP port} & \textbf{Source} & \textbf{Purpose}\\ \midrule
+22 & \texttt{100.8.28.98/32} & Victor's home SSH access\\
+22 & \texttt{155.246.151.38/32} & Victor's campus source; connection still timed out during the reported attempt\\
+22 & \texttt{108.35.228.38/32} & Payton's administrative SSH access\\
+80 & \texttt{0.0.0.0/0} & Existing HTTP website; final proxy redirect/validation behavior pending\\
+443 & \texttt{0.0.0.0/0} & Permitted for planned Caddy HTTPS; opening a rule does not verify a live HTTPS endpoint\\
+\bottomrule
+\end{tabularx}
+No public IPv6 address was shown in the supplied EC2 summary. The provided
+inbound-rule screenshot contains IPv4 rules only. Outbound rules, any other
+attached security groups, and final external exposure require Payton's review.
+
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/security-group-team-access.png}
+\caption{October 15: saved security-group rules, including Payton's source-specific SSH rule. This is configuration evidence, not an external port scan.}
+\label{Figure:GiteaFirewall}
+\end{figure}
+
+During an October 13 campus connection attempt, SSH timed out. Victor's public
+IP had changed from the home address; a campus-specific rule was added, but
+that attempt still failed. Campus filtering was considered but not established.
+On October 15 Victor reported successful SSH access; the exact network for
+that successful session was not recorded. Rules should track current approved
+source addresses rather than permitting public administrative SSH.
+
+\textbf{Pending---Payton:} externally test 443, 80, restricted administrative
+SSH, backend 3000, and database exposure; record source, time, expected and
+actual results, and corrections. Document outbound rules and final Docker
+publishing. HTTPS encrypts an allowed connection; it does not close unrelated
+ports. Local HTTP 200 and loopback mappings do not independently prove public
+firewall behavior.
+
+\section{Startup Team Workflow}
+Victor initialized Gitea with site title \texttt{Inviscid}, created the
+\texttt{victor} administrator, and disabled public self-registration. A separate
+\texttt{payton} regular account was created with a temporary password and
+mandatory password change. A shared Gitea account is not used.
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/member-accounts.png}
+\caption{October 12: separate victor and payton accounts; victor has the site-administrator role. This does not yet establish organization permissions or successful Payton login.}
+\label{Figure:GiteaMembers}
+\end{figure}
+
+On October 15 Victor added Payton's public SSH key to the remote Ubuntu
+account's authorized keys, preserving the existing key and using directory/file
+permissions 700/600. His source IP was allowed separately. Victor subsequently
+reported that Payton connected over SSH successfully and subsequently confirmed
+that his Gitea account worked. His password-change completion was not separately
+captured. Both currently use the Linux \texttt{ubuntu} account with separate
+keys, so Linux account-level attribution remains shared.
+
+\subsection{Organization, Repository, and Roles}
+Victor took responsibility for the Gitea organization/repository work while
+Payton focused on the other infrastructure tasks. Victor created organization
+\texttt{Inviscid} and added \texttt{payton} to its Owners team. Both
+\texttt{victor} and \texttt{payton} therefore administer the organization and
+its repositories; Payton's account is not a site-wide administrator.
+
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/organization-owners.png}
+\caption{October 15: victor and payton are members of the Inviscid Owners team.}
+\label{Figure:GiteaOwners}
+\end{figure}
+
+Victor created \texttt{Inviscid/SSW590-DevOps} without initializing an unrelated
+README commit, then pushed the existing project's \texttt{main} history.
+The repository page showed 13 commits, including the initial Gitea deployment
+commit \texttt{2807081}. GitHub remains the \texttt{origin} remote; the new
+\texttt{gitea} remote points to the tunneled service. The observed commands were:
+\begin{minted}{bash}
+git remote add gitea http://localhost:3000/Inviscid/SSW590-DevOps.git
+git push gitea main:main
+\end{minted}
+
+The intended final organization and repository links are
+\url{https://git.inviscid.dev/Inviscid} and
+\url{https://git.inviscid.dev/Inviscid/SSW590-DevOps}.
+At the recorded checkpoint, access used the equivalent paths at
+\url{http://localhost:3000/} through an SSH tunnel; the final HTTPS links are
+not yet verified. These links must be checked before submission.
+
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/repository-main-import.png}
+\caption{October 15: existing project files and history imported into the organization repository on main.}
+\label{Figure:GiteaRepository}
+\end{figure}
+
+\subsection{Issue 1 and Documentation Pull Request 2}
+Victor created issue \#1, ``Document the initial Gitea deployment and team
+access,'' assigned it to himself, and recorded acceptance criteria covering
+deployment facts, evidence, manual controls, pending work, and Overleaf review.
+Victor reported that he had uploaded the draft to Overleaf, compiled it, and
+visually reviewed it. This is author-reported validation of the earlier draft,
+not verification of later edits or the final combined submission.
+
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/issue-1-documentation.png}
+\caption{October 15: open issue 1, acceptance criteria, and Victor's assignment. Checked criteria do not mean the issue has been merged or closed.}
+\label{Figure:GiteaIssueOne}
+\end{figure}
+
+The changes were made on \texttt{codex/gitea-foundation-docs}, staged and
+checked, then committed as \texttt{da6a369} and pushed:
+\begin{minted}{bash}
+git diff --cached --check
+git diff --cached --stat
+git commit -m "Document initial Gitea deployment and team access; refs #1"
+git push -u gitea codex/gitea-foundation-docs
+\end{minted}
+The commit recorded 12 changed files, 342 insertions, and 32 deletions.
+Victor opened PR \#2 targeting \texttt{main}, included \texttt{Closes \#1}
+in its description, and requested review from \texttt{payton}. Gitea uses a
+shared numbering sequence for issues and PRs: PR \#2 is the first PR, not a
+second completed workflow.
+
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/pr-2-review-request.png}
+\caption{October 15: open PR 2 targets main, links issue 1, and requests Payton's review. Approval and merge are not shown.}
+\label{Figure:GiteaPROpen}
+\end{figure}
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/pr-2-chapter-diff.png}
+\caption{October 15: Files Changed view exposes the documentation additions for peer review.}
+\label{Figure:GiteaPRDiff}
+\end{figure}
+
+The intended final links are
+\url{https://git.inviscid.dev/Inviscid/SSW590-DevOps/issues/1} and
+\url{https://git.inviscid.dev/Inviscid/SSW590-DevOps/pulls/2}.
+These were accessed through the SSH-tunnel hostname at this checkpoint.
+
+\textbf{Pending---Payton and both authors:} Payton's formal review, any
+requested corrections, merge, and issue closure; a separate issue-linked PR
+authored by Payton and reviewed by Victor; README and at least five actionable
+issues, including product and operations work. Only issue 1 and open PR 2 are
+fully evidenced here. The dashboard issue was proposed but its creation was
+not confirmed. Payton has taken ownership of the remaining Gitea tasks.
+The initial main push is not counted as a reviewed PR.
+
+\section{Architecture and Operation}
+The current private initialization path is shown in
+Figure~\ref{Figure:GiteaInitialPath}. Payton will add a final deployment diagram
+showing browser HTTPS to Caddy and private forwarding to Gitea.
+\begin{figure}[htbp]
+\centering
+\fbox{\parbox{0.92\linewidth}{\centering
+Workstation browser: localhost:3000\\
+$\downarrow$ local SSH tunnel\\
+AWS security group: approved source to TCP 22\\
+$\downarrow$ EC2: 100.49.80.94\\
+EC2 loopback:3000 to Gitea container:3000\\
+$\downarrow$ persistent named volume\\
+\texttt{inviscid\_gitea\_data}: repositories, SQLite, configuration}}
+\caption{Initial SSH-tunnel access path. Caddy and hostname-based HTTPS are not yet verified.}
+\label{Figure:GiteaInitialPath}
+\end{figure}
+
+The completed local check \texttt{curl -I http://127.0.0.1:3000/} returned
+HTTP 200. Logs, container status, and the image digest were collected without
+printing configuration secrets.
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/http-image-digest.png}
+\caption{October 12: local HTTP 200 and exact image digest.}
+\label{Figure:GiteaHTTP}
+\end{figure}
+
+The following are operational commands, not additional claimed test results:
+\begin{minted}{bash}
+cd ~/gitea
+sudo docker compose ps
+sudo docker compose logs --tail=40 gitea
+sudo docker compose restart gitea
+\end{minted}
+Closing a workstation tunnel does not stop Gitea on EC2. Reconnect the tunnel
+for browser access. Container replacement should retain the named volume;
+never delete that volume as part of the persistence check. Before destructive
+cleanup, retain needed data. Victor owns the class AWS environment; compute,
+EBS, and public IPv4 are billable and covered by budget alerts rather than a
+spending cap. End-of-course cleanup must include the instance, unneeded storage,
+and release of the Elastic IP; stopping the instance alone is not full cleanup.
+
+\section{Manual Quality and Controls}
+This revision adds the Gitea chapter, updates the Hosts inventory and Elastic IP
+cleanup notes, and adds Gitea account and SSH-key handling hints to the Passwords
+register. No passwords, private keys, database contents, or generated
+\texttt{app.ini} are included. Existing security policies are distinguished
+from observed deployment facts where necessary. Material AI help is recorded
+in \ChapterRef{AIPromptLog}. The linked history entry identifies both table
+updates. Optional backup/restore extra credit is outside this draft's scope.
+
+\textbf{Pending before submission:} finish all pending sections, update the
+final Compose/proxy configuration for \texttt{git.inviscid.dev}, complete the required team workflow,
+verify external exposure and renewal, compile the combined PDF, inspect its
+pages and links, and submit only the PDF. No deadline time was supplied for
+the professor's extension to Thursday, October 15, 2026; check Canvas.
+
+\paragraph{Technical references.}
+\href{https://docs.gitea.com/installation/install-with-docker/}{Gitea Docker installation};
+\href{https://docs.gitea.com/administration/config-cheat-sheet/}{Gitea configuration};
+\href{https://education.github.com/pack}{GitHub Student Developer Pack};
+\href{https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html}{AWS Elastic IP documentation}.

chapters/devopsHosts.tex

@@ -36,7 +36,7 @@ only once it exists and is reachable.
 \multicolumn{4}{l}{\small\itshape Host Inventory (continued)}\\
 \toprule \textbf{Host name} & \textbf{Role} & \textbf{Platform} & \textbf{Status}\\ \midrule
 \endhead \bottomrule \endlastfoot
-\texttt{ssw590-group-web} & Group deployment target. Runs the website in \ChapterRef{CloudDockerDeployment}. & Ubuntu 26.04 LTS on Amazon EC2, \texttt{t3.micro} & In service\\
+\texttt{ssw590-group-web} & Group deployment target. Runs Color Buttons and the Gitea work hub in \ChapterRef{GiteaFoundation}; Elastic IP \texttt{100.49.80.94}; DNS \texttt{git.inviscid.dev} verified October 15 (HTTPS pending). & Ubuntu 26.04 LTS on Amazon EC2, \texttt{t3.micro} & In service\\
 \texttt{ssw590-dev-01} & Primary Linux host for the course. Target for service configuration, deployment exercises, and command-line work. & Ubuntu Server LTS on Amazon EC2 & Planned\\
 \end{tabularx}
 
@@ -44,22 +44,15 @@ only once it exists and is reachable.
 \index{hosts!access model}
 \index{least privilege}
 \texttt{ssw590-group-web} is shared by both authors and runs under Victor's AWS account,
-where each author has a separate IAM identity. The following rules are the target access policy
-for course Linux hosts:
-
-\begin{itemize}[leftmargin=*]
-\item Interactive access is by \gls{ssh} public key only.
-      Password authentication is disabled in the server configuration.
-      The local account password recorded in \ChapterRef{Passwords} authenticates \texttt{sudo} only.
-\item Inbound \gls{ssh} is restricted by source address to the local workstation
-	  rather than opened to the public Internet.
-\item Day-to-day work is performed by an unprivileged account. Administrative
-      rights are granted per command rather than by general membership in the
-      \texttt{sudo} group.
-\item Teammates who require access after teams are formalized
-      receive a separate named account rather than a shared login, so that
-      access can be revoked individually and actions remain attributable.
-\end{itemize}
+where each author has a separate IAM identity. For the Gitea deployment, both authors currently connect to the Linux
+\texttt{ubuntu} account using separate public keys. Victor is a Gitea site
+administrator; Payton has a separate regular Gitea account. Both are members
+of the Inviscid organization Owners team. Linux account-level
+attribution is shared; per-person Linux accounts remain a future improvement.
+Administrative SSH is restricted to approved source IPv4 addresses. The
+observed rules and connection limitations are in \ChapterRef{GiteaFoundation}.
+This inventory does not claim that SSH password authentication or sudo policy
+was independently audited during this exercise.
 
 \section{Cost and Cleanup}
 \index{hosts!cost}
@@ -73,7 +66,6 @@ compute cost of the environment. It is therefore left unprovisioned unless
 required in the future, and would be stopped between uses rather than run continuously.
 
 Course hosts are disposable. Teardown consists of terminating the instance and
-deleting its storage volume. \texttt{ssw590-group-web} uses an automatically
-assigned public address rather than a reserved static address, so there is no
-address to release; its address changes if the instance is stopped and
-started.
+deleting its storage volume. \texttt{ssw590-group-web} uses Elastic IP \texttt{100.49.80.94}, associated on October 12, 2026.
+Release that allocation when no longer required; stopping or terminating an
+instance alone does not release the Elastic IP.

chapters/devopsIntroduction.tex

@@ -10,7 +10,8 @@ This document records the configuration of the development environment used for
 \CourseNumber\ and the working practices followed to produce it.
 Each chapter covers one subject, and each assignment adds or revises chapters
 as recorded in the document history. The latest revision for Assignment~\AssignmentNumber\
-adds \ChapterRef{CloudDockerDeployment}, \ChapterRef{LatexDocker}, and \ChapterRef{ProjectProposal}.
+adds \ChapterRef{GiteaFoundation}, recording the initial Gitea deployment
+and the pending checks required to complete the assignment.
 Earlier coursework chapters are retained.
 
 \section{Scope and Constraints}
@@ -39,7 +40,7 @@ Due date & \DueDate\\
 Instructor & \Instructor\\
 Team & \Author\\
 Board & GitHub Projects, \texttt{SSW 590} (private; captured as figures in \ChapterRef{KanbanSetup})\\
-Required deliverables & Compiled group manual; cloud deployment, LaTeX Docker exercise, tool proposal, and updated history\\
+Required deliverables & Compiled group manual with the eight Gitea rubric sections, configuration and test evidence, updated history, Hosts, and Passwords hints\\
 Team policy & Group submission\\ \bottomrule
 \end{tabularx}
 
@@ -62,6 +63,8 @@ the Template Attribution page. The template's instructional example chapter and
 its template-maintenance appendices have been removed, since they describe how
 to author the template rather than the environment this document records.
 
+\ChapterRef{GiteaFoundation} records the persistent work hub, team access, and pending domain, HTTPS, and workflow evidence.
+
 \section{Tools and AI Assistance}
 \index{AI assistance}
 AI assistance was used in preparing this document for drafting, review, and

chapters/devopsPasswords.tex

@@ -42,14 +42,18 @@ only where a generated secret cannot be retrieved.
 \multicolumn{4}{l}{\small\itshape Account, Server, and Password Rule Register (continued)}\\
 \toprule \textbf{User} & \textbf{Server or service} & \textbf{Class} & \textbf{Rule and hint}\\ \midrule
 \endhead \bottomrule \endlastfoot
+Victor & Name.com registrar & Private account & Domain inviscid.dev; credentials held outside Git/report. Victor manages renewal; auto-renewal enabled.\\
+\texttt{victor} & Gitea (Inviscid) & Unique & Site administrator; password kept outside this report and repository.\\
+\texttt{payton} & Gitea (Inviscid) & Temporary & Initial password delivered separately; mandatory change configured. Successful login reported; password-change completion not separately evidenced.\\
+Both authors & EC2 \texttt{ubuntu} & SSH key & Separate private keys remain on each author's workstation; only public keys authorized on EC2. No private keys in Git.\\
 \texttt{root} & \texttt{ssw590-dev-01} & None & No password. Administrative access is obtained through \texttt{sudo} by a named account, so that privileged actions are attributable.\\
 \texttt{payton} & \texttt{ssw590-dev-01}, \texttt{ssw590-build-01} & Derived & Used only to authenticate \texttt{sudo}; \gls{ssh} password authentication is disabled, so this secret never crosses the network.
 \textit{Psst... sudo is a name, no?}\\
 \texttt{ssw-app} & \texttt{ssw590-dev-01} & Generated & Unprivileged service account for course applications. Secret held in a file readable only by that account, excluded from the repository, and rotated per deployment.\\
 Master & Password manager vault & Derived & A memorized password that isn't stored in its own vault.
 \textit{Surely it's secure, no lie?}\\
-Root user & AWS account & Generated & Reserved for account recovery and billing; \gls{mfa} enforced, not used for routine work.\\
-\texttt{payton-admin} & AWS console, \gls{iam} & Generated & Day-to-day console account. \gls{mfa} enforced. Programmatic access uses short-lived credentials rather than a stored key pair.\\
+Root user & AWS account & Generated & Existing account policy: recovery and billing. Victor previously reported administrative root use and deferred MFA; current MFA state not verified.\\
+Payton & AWS console, Identity Center & Separate identity & EC2 permission set configured previously; current MFA state not verified.\\
 \end{tabularx}
 
 \section{Handling and Storage}
@@ -60,7 +64,7 @@ The following rules apply to every entry above.
 \begin{itemize}[leftmargin=*]
 \item No password, private key, access token, or recovery code is recorded anywhere non-secure.
       A secret is referred to by the location that holds it.
-\item \gls{mfa} is enabled on every account that supports it.
+\item Target policy: enable \gls{mfa} wherever supported. This is not a claim that every current account has been verified as compliant.
 \item A generated password is rotated by replacement. Any password is
       rotated immediately if it is disclosed, and knowing one password
       does not provide insight into other passwords.

devopsAssignment.tex

@@ -38,17 +38,17 @@
 \definecolor{devopsLightBlue}{RGB}{232,240,247}
 
 % Replace these values for each assignment.
-\newcommand{\AssignmentTitle}{Cloud Docker Deployment, LaTeX Docker, and Project Proposal}
-\newcommand{\AssignmentNumber}{3}
-\newcommand{\DocumentVersion}{3.2}
+\newcommand{\AssignmentTitle}{Startup Foundation with Gitea}
+\newcommand{\AssignmentNumber}{4}
+\newcommand{\DocumentVersion}{4.1}
 \newcommand{\DocumentStatus}{Submitted Document}
 \newcommand{\CourseNumber}{SSW 590}
 \newcommand{\CourseName}{DevOps}
 \newcommand{\Author}{Payton Bates and Victor Del Rio Foces}
 \newcommand{\Instructor}{Darian Muresan, Ph.D.}
 \newcommand{\Organization}{Stevens Institute of Technology}
-\newcommand{\DocumentDate}{October 6, 2026}
-\newcommand{\DueDate}{October 6, 2026 by 11:59pm}
+\newcommand{\DocumentDate}{October 15, 2026}
+\newcommand{\DueDate}{October 15, 2026 (submission time: see Canvas)}
 \newcommand{\VERSION}{Version \DocumentVersion}
 
 \hypersetup{
@@ -124,6 +124,7 @@
 \include{chapters/devopsCloudDockerDeployment}
 \include{chapters/devopsLatexDocker}
 \include{chapters/devopsProjectProposal}
+\include{chapters/devopsGiteaFoundation}
 
 \appendix
 \include{backmatter/devopsAIPromptLog}

docker/gitea/README.md

@@ -1,6 +1,6 @@
 # Inviscid Gitea foundation
 
-This is the temporary, Gitea-only deployment while Student Pack registration is pending.
+This is the temporary, Gitea-only deployment used before the domain was registered; retain it as the initial deployment configuration.
 The official image version is pinned; verify that it pulls before starting the service.
 SQLite is `/data/gitea/gitea.db`; repositories and other application data share the
 persistent named volume `inviscid_gitea_data`. Container replacement must preserve it.
@@ -42,8 +42,7 @@ Sources:
 - Gitea initialized with site title Inviscid; victor is administrator and payton is a regular user.
 - Local HTTP check returned 200; named-volume mount and SQLite file were verified.
 - Both containers remained running following Elastic IP association.
-- Domain registration, public HTTPS, renewal verification, external firewall checks,
-  container-replacement persistence test, and team PR workflow remain incomplete.
+- This October 12 configuration predates domain registration; see the October 15 update below.
 
 For private browser access, use your own authorized key:
 
@@ -53,3 +52,21 @@ ssh -i /path/to/your-private-key -o ExitOnForwardFailure=yes -N -L 127.0.0.1:300
 
 Open http://localhost:3000 while the tunnel stays open. Each team member must
 have their public key authorized and their source IP allowed for administrative SSH.
+
+## October 15 handoff update
+
+- Student Pack domain offer redeemed: `inviscid.dev`, Name.com, one year at $0.00.
+- Displayed renewal: October 15, 2027 at $22.99; auto-renew enabled. Victor owns renewal.
+- Saved A record: `git.inviscid.dev` -> `100.49.80.94`, TTL 300.
+- Windows lookups via 1.1.1.1 and 8.8.8.8 both returned that IP at 19:17 EDT.
+- Both users are organization owners of `Inviscid`; Payton's SSH/Gitea access works per Victor.
+- Existing main history pushed to `Inviscid/SSW590-DevOps`; issue #1 and PR #2 created.
+- PR #2 (`da6a369`, `codex/gitea-foundation-docs`) awaits Payton's review and merge.
+- Payton owns the remaining Gitea tasks; Victor will review his separate PR.
+- Public HTTPS, renewal tests, external exposure, container replacement persistence,
+  README/five-issue completion, and two completed reviewed PR workflows are not yet verified.
+
+Payton: update DOMAIN to `git.inviscid.dev` and ROOT_URL to
+`https://git.inviscid.dev/` alongside Caddy configuration. The tracked Compose
+file still intentionally records the initial localhost setup; do not interpret
+the new DNS record as proof that HTTPS has been deployed.

frontmatter/abstract.tex

@@ -9,3 +9,11 @@ on Amazon EC2, with public browser and terminal verification evidence;
 a Docker container that compiles \LaTeX\ documents as Overleaf does;
 and the Inviscid monitoring-service proposal, including a planned comparison
 of Prometheus and VictoriaMetrics.
+
+Assignment 4 records the persistent Gitea service on the existing EC2 host,
+Elastic IP association, and separate team access. It also records Student Pack
+domain redemption, inviscid.dev registration and independently verified DNS,
+organization ownership, repository import, and the first open issue-linked PR.
+Public HTTPS, renewal and external exposure tests, container-replacement
+persistence verification, and both completed reviewed-merge workflows remain
+pending in this draft.

frontmatter/devopsDocumentHistory.tex

@@ -11,6 +11,8 @@ link each entry to the changed chapter, table, figure, or controlled artifact.
 \multicolumn{4}{l}{\small\itshape Document Update History (continued)}\\
 \toprule \textbf{Date / Version} & \textbf{Author Initials} & \textbf{Change} & \textbf{Changed At}\\ \midrule
 \endhead \bottomrule \endlastfoot
+October 15, 2026 / 4.1 & VDRF & Recorded Student Pack redemption, inviscid.dev registration/renewal, DNS record and two independent lookups, organization ownership, repository import, issue 1, and open PR 2. Updated Hosts domain entry, Passwords registrar/account hints, abstract, AI log, and deployment handoff notes; HTTPS and reviewed merges remain pending. & \ChapterRef{GiteaFoundation}, \ChapterRef{Hosts}, \ChapterRef{Passwords}, \ChapterRef{AIPromptLog}\\
+October 15, 2026 / 4.0 & VDRF & Added the initial Gitea foundation chapter with deployment, SQLite, Elastic IP, access evidence, and explicit pending DNS/HTTPS/workflow items. Updated Hosts inventory and cleanup, Passwords account/hint table and policy-versus-observation wording, metadata, abstract, introduction, and AI log. & \ChapterRef{GiteaFoundation}, \ChapterRef{Hosts}, \ChapterRef{Passwords}, \ChapterRef{AIPromptLog}\\
 October 6, 2026 / 3.2 & VDRF & Replaced the preliminary tool proposal with Inviscid, its sample customer task, tentative stack, research question, and independent SWOT assessments of Prometheus and VictoriaMetrics. Updated the abstract and AI log. & \ChapterRef{ProjectProposal}, \ChapterRef{AIPromptLog}\\
 October 5, 2026 / 3.1 & PCB & Added the LaTeX Docker chapter for compiling a sample document with its sources, build and run commands, and test evidence. Updated the document title, keywords, glossary,  abstract, introduction, and hosts. & \ChapterRef{LatexDocker}, \ChapterRef{Hosts}, \ChapterRef{Introduction}, \ChapterRef{CloudDockerDeployment}\\
 October 5, 2026 / 3.0 & VDRF & Added AWS Docker deployment, class-based website sources, execution evidence, and a draft tool-comparison proposal. Updated Assignment 3 metadata and AI log. & \ChapterRef{CloudDockerDeployment}, \ChapterRef{ProjectProposal}, \ChapterRef{AIPromptLog}\\