Document initial Gitea deployment and team access; refs #1

chapters/devopsHosts.tex

@@ -36,7 +36,7 @@ only once it exists and is reachable.
 \multicolumn{4}{l}{\small\itshape Host Inventory (continued)}\\
 \toprule \textbf{Host name} & \textbf{Role} & \textbf{Platform} & \textbf{Status}\\ \midrule
 \endhead \bottomrule \endlastfoot
-\texttt{ssw590-group-web} & Group deployment target. Runs the website in \ChapterRef{CloudDockerDeployment}. & Ubuntu 26.04 LTS on Amazon EC2, \texttt{t3.micro} & In service\\
+\texttt{ssw590-group-web} & Group deployment target. Runs Color Buttons and the Gitea work hub in \ChapterRef{GiteaFoundation}; Elastic IP \texttt{100.49.80.94}. & Ubuntu 26.04 LTS on Amazon EC2, \texttt{t3.micro} & In service\\
 \texttt{ssw590-dev-01} & Primary Linux host for the course. Target for service configuration, deployment exercises, and command-line work. & Ubuntu Server LTS on Amazon EC2 & Planned\\
 \end{tabularx}
 
@@ -44,22 +44,14 @@ only once it exists and is reachable.
 \index{hosts!access model}
 \index{least privilege}
 \texttt{ssw590-group-web} is shared by both authors and runs under Victor's AWS account,
-where each author has a separate IAM identity. The following rules are the target access policy
-for course Linux hosts:
-
-\begin{itemize}[leftmargin=*]
-\item Interactive access is by \gls{ssh} public key only.
-      Password authentication is disabled in the server configuration.
-      The local account password recorded in \ChapterRef{Passwords} authenticates \texttt{sudo} only.
-\item Inbound \gls{ssh} is restricted by source address to the local workstation
-	  rather than opened to the public Internet.
-\item Day-to-day work is performed by an unprivileged account. Administrative
-      rights are granted per command rather than by general membership in the
-      \texttt{sudo} group.
-\item Teammates who require access after teams are formalized
-      receive a separate named account rather than a shared login, so that
-      access can be revoked individually and actions remain attributable.
-\end{itemize}
+where each author has a separate IAM identity. For the Gitea deployment, both authors currently connect to the Linux
+\texttt{ubuntu} account using separate public keys. Victor is a Gitea site
+administrator; Payton has a separate regular Gitea account. Linux account-level
+attribution is shared; per-person Linux accounts remain a future improvement.
+Administrative SSH is restricted to approved source IPv4 addresses. The
+observed rules and connection limitations are in \ChapterRef{GiteaFoundation}.
+This inventory does not claim that SSH password authentication or sudo policy
+was independently audited during this exercise.
 
 \section{Cost and Cleanup}
 \index{hosts!cost}
@@ -73,7 +65,6 @@ compute cost of the environment. It is therefore left unprovisioned unless
 required in the future, and would be stopped between uses rather than run continuously.
 
 Course hosts are disposable. Teardown consists of terminating the instance and
-deleting its storage volume. \texttt{ssw590-group-web} uses an automatically
-assigned public address rather than a reserved static address, so there is no
-address to release; its address changes if the instance is stopped and
-started.
+deleting its storage volume. \texttt{ssw590-group-web} uses Elastic IP \texttt{100.49.80.94}, associated on October 12, 2026.
+Release that allocation when no longer required; stopping or terminating an
+instance alone does not release the Elastic IP.