feat: architecture diagram and operations explanation

chapters/devopsGiteaFoundation.tex

@@ -374,9 +374,16 @@ not confirmed. Payton has taken ownership of the remaining Gitea tasks.
 The initial main push is not counted as a reviewed PR.
 
 \section{Architecture and Operation}
-The current private initialization path is shown in
-Figure~\ref{Figure:GiteaInitialPath}. Payton will add a final deployment diagram
-showing browser HTTPS to Caddy and private forwarding to Gitea.
+Figure~\ref{Figure:GiteaArchitecture} shows the deployed request and data paths.
+\begin{figure}[htbp]
+\centering
+\resizebox{\linewidth}{!}{\input{figures/devopsGiteaFoundation/giteaArchitecture}}
+\caption{October 15: deployed architecture. The security group admits 443 and 80 from any source and 22 only from approved team addresses. Caddy is the only container publishing host ports; Gitea, the Color Buttons app, and both data volumes are private.}
+\label{Figure:GiteaArchitecture}
+\end{figure}
+
+The initial October 12 access path, before Caddy was deployed, is kept for
+reference in Figure~\ref{Figure:GiteaInitialPath}.
 \begin{figure}[htbp]
 \centering
 \fbox{\parbox{0.92\linewidth}{\centering
@@ -387,7 +394,7 @@ $\downarrow$ EC2: 100.49.80.94\\
 EC2 loopback:3000 to Gitea container:3000\\
 $\downarrow$ persistent named volume\\
 \texttt{inviscid\_gitea\_data}: repositories, SQLite, configuration}}
-\caption{Initial SSH-tunnel access path. Caddy and hostname-based HTTPS are not yet verified.}
+\caption{October 12: initial SSH-tunnel-only access path, before Caddy and hostname-based HTTPS were deployed.}
 \label{Figure:GiteaInitialPath}
 \end{figure}
 
@@ -406,8 +413,40 @@ The following are operational commands, not additional claimed test results:
 cd ~/gitea
 sudo docker compose ps
 sudo docker compose logs --tail=40 gitea
+sudo docker compose logs --tail=40 caddy
 sudo docker compose restart gitea
+sudo docker compose restart caddy
 \end{minted}
+
+\paragraph{Where data lives.} Repositories, attachments, Gitea configuration,
+and the SQLite database (\path{/data/gitea/gitea.db}) live in the named volume
+\texttt{inviscid\_gitea\_data}. Certificates and the ACME account live in
+\texttt{inviscid\_caddy\_data} (with \texttt{inviscid\_caddy\_config}). All
+three volumes are on the instance's EBS disk, outside the disposable container
+layers. Deployment files are versioned in \path{docker/gitea/} of the repository.
+
+\paragraph{Public and private interfaces.} Public: TCP 443 (HTTPS to Caddy) and
+TCP 80 (redirect to HTTPS, ACME validation, and the Color Buttons app by IP),
+both from any source. Restricted: TCP 22 (administrative SSH) from approved team
+addresses only. Private: Gitea's port 3000 (reachable only on the Compose network
+and EC2 loopback), the Color Buttons container's port 3000, Caddy's admin port
+2019, and the SQLite file, which has no network port.
+
+\paragraph{Troubleshooting.} If \url{https://git.inviscid.dev} fails, check in
+order: (1) \texttt{docker compose ps} shows both services running; (2) the Caddy
+log shows no certificate or upstream errors; (3) the Gitea log shows it listening
+on port 3000; (4) \texttt{curl -I http://127.0.0.1:3000/} on EC2 returns 200,
+which isolates Gitea from Caddy; (5) DNS still resolves to the Elastic IP and the
+security group still admits 443. Restarting one service leaves its volume intact.
+
+\paragraph{Persistence test versus backup/restore.} The container-replacement
+test shows that data survives when the Gitea \emph{container} is discarded,
+because the named volume is reattached. It does not protect against loss of the
+volume, the EBS disk, or the instance, and it creates no copy elsewhere. A
+backup/restore test would copy the volume and database to separate storage and
+prove recovery into a different instance; that optional exercise
+(Section~2.8 of the assignment) was not performed.
+
 Closing a workstation tunnel does not stop Gitea on EC2. Reconnect the tunnel
 for browser access. Container replacement should retain the named volume;
 never delete that volume as part of the persistence check. Before destructive