Document initial Gitea deployment and team access; refs #1

backmatter/devopsAIPromptLog.tex

@@ -139,3 +139,22 @@ explicitly marked undecided.\\
 pipeline remain proposed work. No performance results or completed monitoring
 features are claimed. The combined report still requires final author review
 and compilation before submission.
+
+
+\subsection{Record 8 --- Gitea Foundation and Evidence Draft}
+\textbf{Dates:} October 12--15, 2026.\\
+\textbf{Tool:} OpenAI Codex.\\
+\textbf{Task:} Guide Victor through Student Pack application, Docker/SQLite
+Gitea setup, SSH tunneling, Elastic IP association, and Payton's key access;
+prepare the pre-PR documentation from supplied execution evidence.\\
+\textbf{Human contribution:} Victor operated the consoles and terminals,
+created accounts, supplied screenshots, and reported Payton's successful SSH
+connection. Payton's remaining work was not executed by the assistant.\\
+\textbf{Output used:} Non-secret Compose configuration, deployment notes,
+saved screenshots, Gitea chapter draft, and matching inventory, account-hint,
+history, and metadata updates.\\
+\textbf{Corrections and limits:} Documented benefit activation separately from
+academic approval; recorded the current Elastic IP and the unresolved campus
+SSH timeout; did not infer public HTTPS or persistence replacement success
+from local checks. Domain details, renewal and external checks, PR workflows,
+final compilation, and submission remain unverified.

backmatter/glossary.tex

@@ -14,3 +14,7 @@
 \newglossaryentry{texlive}{name={TeX Live},description={A cross-platform
   distribution of the \TeX\ engines, \LaTeX\ packages, fonts, and tools; the
   distribution Overleaf compiles with}}
+\newglossaryentry{sqlite}{name={SQLite},description={An embedded database stored
+in a local file; Gitea's selected database for the initial two-person deployment}}
+\newglossaryentry{elasticip}{name={Elastic IP},description={An allocated AWS
+public IPv4 address that can remain associated with the deployment across instance restarts}}

chapters/devopsGiteaFoundation.tex

@@ -0,0 +1,283 @@
+\chapter{Startup Foundation with Gitea}
+\ChapterLabel{GiteaFoundation}
+\index{Gitea}\index{SQLite}\index{Docker Compose}\index{Elastic IP}\index{SSH tunnel}
+
+This chapter records the initial Inviscid work hub on the existing Amazon EC2
+server. AWS is used in place of the assignment's DigitalOcean deployment.
+The dated screenshots record completed work; pending items below are not
+represented as passed. This draft covers Victor's deployment and access setup.
+
+\section{Student Pack Domain and DNS}
+Victor submitted school enrollment evidence to GitHub Education on October 12,
+2026. Academic status was approved that day, but the portal displayed
+``Awaiting Benefits'' and stated that partner offers would activate after
+72 hours (Figure~\ref{Figure:GiteaBenefits}). At the October 15 drafting
+checkpoint, Victor reported that benefits were still unavailable.
+
+\textbf{Pending:} redeem an eligible Student Pack domain offer; record the
+provider, eligibility, first-year charge, renewal charge, expiration, and renewal
+owner; configure the selected Gitea hostname and capture an independent DNS
+lookup. \texttt{inviscid.net} is a preference, not a registered or verified
+domain in this record. The selected offer must determine which extension is
+eligible. The intended DNS A record will point the selected hostname to
+\texttt{100.49.80.94}. Domain ownership and renewal will be recorded when the
+offer is redeemed; no registration cost or expiry is invented here.
+
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/student-pack-approved-awaiting-benefits.png}
+\caption{October 12: academic status approved, with partner benefits still awaiting activation. This establishes the dependency blocking domain redemption, not a completed registration.}
+\label{Figure:GiteaBenefits}
+\end{figure}
+
+\section{Pinned Gitea Deployment}
+The existing \texttt{ssw590-group-web} instance runs Ubuntu 26.04 LTS on a
+\texttt{t3.micro} in \texttt{us-east-1}. The initial resource check recorded
+908 MiB total memory, 468 MiB available memory, and 3.1 GiB available root disk.
+Docker Compose reported version 5.6.0. The existing Color Buttons container
+continued to serve host port 80 while Gitea was initialized privately.
+
+\begin{tabularx}{\linewidth}{L{3.5cm}Y}
+\caption{Recorded Gitea Deployment\label{Table:GiteaDeployment}}\\
+\toprule \textbf{Setting} & \textbf{Value}\\ \midrule
+Instance & \texttt{i-025a57432604c8d4b}, \texttt{ssw590-group-web}\\
+Current public address & Elastic IP \texttt{100.49.80.94}\\
+Private address & \texttt{172.31.19.91}\\
+Official image & \texttt{docker.gitea.com/gitea:28.1.0}\\
+Container & \texttt{inviscid-gitea-1}\\
+Remote working directory & \path{/home/ubuntu/gitea}\\
+Persistent volume & \texttt{inviscid\_gitea\_data}, mounted at \path{/data}\\
+Docker network & \texttt{inviscid\_services}\\
+Restart policy & \texttt{unless-stopped}\\
+Published backend & \texttt{127.0.0.1:3000:3000}; no public backend mapping\\
+Temporary public URL setting & \url{http://localhost:3000/}; SSH-tunnel access only\\
+\bottomrule
+\end{tabularx}
+
+The official Docker installation guide supports persistent application storage
+and SQLite initialization. We pinned a version rather than using a floating
+\texttt{latest} tag. The recorded repository digest is:
+\begin{minted}[fontsize=\scriptsize]{text}
+docker.gitea.com/gitea@sha256:f505a0d3a41323b786e05942fc7a4075e07ae7c169fd9485649aa55ee543a21a
+\end{minted}
+
+The non-secret configuration is maintained in
+\href{https://github.com/byterand/SSW590-DevOps/tree/main/docker/gitea}{the team's versioned deployment directory}.
+The following file is the initial localhost-only configuration. Its URL settings
+must be updated for the registered HTTPS hostname before final submission.
+\inputminted{yaml}{docker/gitea/compose.yaml}
+
+Victor copied the directory from the Windows workstation to EC2 using
+\texttt{scp}. In the remote directory, he validated, pulled, and started it:
+\begin{minted}{bash}
+cd ~/gitea
+sudo docker compose config --quiet
+sudo docker compose pull
+sudo docker compose up -d
+sudo docker compose ps
+sudo docker compose logs --tail=40 gitea
+\end{minted}
+Validation returned without an error, the pinned image pulled, and Compose
+created the volume, network, and container. Startup logs showed Gitea 28.1.0
+listening internally on port 3000 and preparing its installation page.
+
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/compose-validation-pull.png}
+\caption{October 12: successful Compose validation and pull of the pinned official image.}
+\label{Figure:GiteaPull}
+\end{figure}
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/container-startup.png}
+\caption{October 12: container startup and localhost port mapping. The image exposes an internal SSH port, but no host SSH mapping was published for Gitea.}
+\label{Figure:GiteaStartup}
+\end{figure}
+
+Victor associated the Elastic IP with the same instance, replacing the earlier
+\texttt{54.221.175.174} address. The containers remained running. SSH and tunnel
+commands were updated to use the new address; the data and private address did
+not change.
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/elastic-ip-association.png}
+\caption{October 12: Elastic IP 100.49.80.94 associated with the existing instance.}
+\label{Figure:GiteaElasticIP}
+\end{figure}
+
+\section{Database and Persistence}
+SQLite was selected for the small two-person deployment. It requires no
+separate database service or network port. The database is at
+\path{/data/gitea/gitea.db}, within the same persistent named volume that holds
+application configuration and repository data. The volume exists outside the
+disposable container layer. Generated configuration, database contents, and
+secrets are not stored in the Git repository.
+
+The following checks were executed on October 12:
+\begin{minted}{bash}
+sudo docker inspect inviscid-gitea-1 --format '{{range .Mounts}}{{println .Type .Name .Destination}}{{end}}'
+sudo docker compose exec -T gitea ls -lh /data/gitea/gitea.db
+sudo docker stats --no-stream
+free -h
+df -h /
+\end{minted}
+The mount check showed \texttt{inviscid\_gitea\_data} at \path{/data}; the
+SQLite file existed and was approximately 2.1 MiB. Gitea used approximately
+187 MiB RAM in that snapshot, with 367 MiB system memory and 2.8 GiB disk
+available. These are single observations, not load-test results.
+
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/storage-resources.png}
+\caption{October 12: named-volume mount, database file, and resource checks. These verify storage configuration, not survival of a container replacement.}
+\label{Figure:GiteaStorage}
+\end{figure}
+
+\textbf{Pending---Payton:} record a repository and issue, replace only the
+Gitea container without deleting its volume, and show that both remain usable.
+Include identifiers, exact command, before/after evidence, and conclusion.
+This required test is distinct from the optional backup/restore exercise.
+
+\section{HTTPS and Certificate Renewal}
+\textbf{Pending---Payton:} compare two certificate options and justify one;
+configure Caddy using the final hostname, persistent certificate state, and
+private forwarding to \texttt{gitea:3000}; update Gitea's domain and public URL;
+record issuer, expiry, redirect, renewal automation, and a successful renewal
+test or dry run. The existing website's host-port-80 mapping must be resolved
+before Caddy publishes that port. Public HTTPS is not claimed in this draft.
+
+Initial access used an SSH tunnel from the workstation:
+\begin{minted}{bash}
+ssh -i /path/to/your-private-key -o ExitOnForwardFailure=yes -N -L 127.0.0.1:3000:127.0.0.1:3000 ubuntu@100.49.80.94
+\end{minted}
+The browser opened \url{http://localhost:3000/}; transport between workstation
+and server was encrypted by SSH, but this is not hostname-based HTTPS and does
+not satisfy the final certificate requirement. Each workstation needs its own
+tunnel. The \texttt{-N} option keeps the connection open without a remote shell.
+
+\section{Firewall and External Exposure}
+The attached AWS security group is \texttt{ssw590-web-sg}, identifier
+\texttt{sg-0a9eb6dcfc906e78b}. The October 15 screenshot records these IPv4 rules:
+\begin{tabularx}{\linewidth}{L{2cm}L{4cm}Y}
+\toprule \textbf{TCP port} & \textbf{Source} & \textbf{Purpose}\\ \midrule
+22 & \texttt{100.8.28.98/32} & Victor's home SSH access\\
+22 & \texttt{155.246.151.38/32} & Victor's campus source; connection still timed out during the reported attempt\\
+22 & \texttt{108.35.228.38/32} & Payton's administrative SSH access\\
+80 & \texttt{0.0.0.0/0} & Existing HTTP website; final proxy redirect/validation behavior pending\\
+443 & \texttt{0.0.0.0/0} & Permitted for planned Caddy HTTPS; opening a rule does not verify a live HTTPS endpoint\\
+\bottomrule
+\end{tabularx}
+No public IPv6 address was shown in the supplied EC2 summary. The provided
+inbound-rule screenshot contains IPv4 rules only. Outbound rules, any other
+attached security groups, and final external exposure require Payton's review.
+
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/security-group-team-access.png}
+\caption{October 15: saved security-group rules, including Payton's source-specific SSH rule. This is configuration evidence, not an external port scan.}
+\label{Figure:GiteaFirewall}
+\end{figure}
+
+During an October 13 campus connection attempt, SSH timed out. Victor's public
+IP had changed from the home address; a campus-specific rule was added, but
+that attempt still failed. Campus filtering was considered but not established.
+On October 15 Victor reported successful SSH access; the exact network for
+that successful session was not recorded. Rules should track current approved
+source addresses rather than permitting public administrative SSH.
+
+\textbf{Pending---Payton:} externally test 443, 80, restricted administrative
+SSH, backend 3000, and database exposure; record source, time, expected and
+actual results, and corrections. Document outbound rules and final Docker
+publishing. HTTPS encrypts an allowed connection; it does not close unrelated
+ports. Local HTTP 200 and loopback mappings do not independently prove public
+firewall behavior.
+
+\section{Startup Team Workflow}
+Victor initialized Gitea with site title \texttt{Inviscid}, created the
+\texttt{victor} administrator, and disabled public self-registration. A separate
+\texttt{payton} regular account was created with a temporary password and
+mandatory password change. A shared Gitea account is not used.
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/member-accounts.png}
+\caption{October 12: separate victor and payton accounts; victor has the site-administrator role. This does not yet establish organization permissions or successful Payton login.}
+\label{Figure:GiteaMembers}
+\end{figure}
+
+On October 15 Victor added Payton's public SSH key to the remote Ubuntu
+account's authorized keys, preserving the existing key and using directory/file
+permissions 700/600. His source IP was allowed separately. Victor subsequently
+reported that Payton connected over SSH successfully; Gitea login testing was
+still underway. Both currently use the Linux \texttt{ubuntu} account with
+separate keys, so Linux account-level attribution remains shared.
+
+\textbf{Pending---Payton and both authors:} confirm Payton's Gitea login and
+password change; create the organization, product repository, README, member
+roles, and five actionable issues. Link the organization and repository here.
+Then each author completes an issue-linked branch and PR, receives peer review,
+merges, and closes the issue. Capture both complete cycles. The initial GitHub
+push is not counted as a reviewed Gitea PR.
+
+\section{Architecture and Operation}
+The current private initialization path is shown in
+Figure~\ref{Figure:GiteaInitialPath}. Payton will add a final deployment diagram
+showing browser HTTPS to Caddy and private forwarding to Gitea.
+\begin{figure}[htbp]
+\centering
+\fbox{\parbox{0.92\linewidth}{\centering
+Workstation browser: localhost:3000\\
+$\downarrow$ local SSH tunnel\\
+AWS security group: approved source to TCP 22\\
+$\downarrow$ EC2: 100.49.80.94\\
+EC2 loopback:3000 to Gitea container:3000\\
+$\downarrow$ persistent named volume\\
+\texttt{inviscid\_gitea\_data}: repositories, SQLite, configuration}}
+\caption{Initial SSH-tunnel access path. Caddy and hostname-based HTTPS are not yet verified.}
+\label{Figure:GiteaInitialPath}
+\end{figure}
+
+The completed local check \texttt{curl -I http://127.0.0.1:3000/} returned
+HTTP 200. Logs, container status, and the image digest were collected without
+printing configuration secrets.
+\begin{figure}[htbp]
+\centering
+\includegraphics[width=\linewidth]{figures/gitea/http-image-digest.png}
+\caption{October 12: local HTTP 200 and exact image digest.}
+\label{Figure:GiteaHTTP}
+\end{figure}
+
+The following are operational commands, not additional claimed test results:
+\begin{minted}{bash}
+cd ~/gitea
+sudo docker compose ps
+sudo docker compose logs --tail=40 gitea
+sudo docker compose restart gitea
+\end{minted}
+Closing a workstation tunnel does not stop Gitea on EC2. Reconnect the tunnel
+for browser access. Container replacement should retain the named volume;
+never delete that volume as part of the persistence check. Before destructive
+cleanup, retain needed data. Victor owns the class AWS environment; compute,
+EBS, and public IPv4 are billable and covered by budget alerts rather than a
+spending cap. End-of-course cleanup must include the instance, unneeded storage,
+and release of the Elastic IP; stopping the instance alone is not full cleanup.
+
+\section{Manual Quality and Controls}
+This revision adds the Gitea chapter, updates the Hosts inventory and Elastic IP
+cleanup notes, and adds Gitea account and SSH-key handling hints to the Passwords
+register. No passwords, private keys, database contents, or generated
+\texttt{app.ini} are included. Existing security policies are distinguished
+from observed deployment facts where necessary. Material AI help is recorded
+in \ChapterRef{AIPromptLog}. The linked history entry identifies both table
+updates. Optional backup/restore extra credit is outside this draft's scope.
+
+\textbf{Pending before submission:} finish all pending sections, update DNS
+and final Compose/proxy configuration, complete the required team workflow,
+verify external exposure and renewal, compile the combined PDF, inspect its
+pages and links, and submit only the PDF. No deadline time was supplied for
+the professor's extension to Thursday, October 15, 2026; check Canvas.
+
+\paragraph{Technical references.}
+\href{https://docs.gitea.com/installation/install-with-docker/}{Gitea Docker installation};
+\href{https://docs.gitea.com/administration/config-cheat-sheet/}{Gitea configuration};
+\href{https://education.github.com/pack}{GitHub Student Developer Pack};
+\href{https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html}{AWS Elastic IP documentation}.

chapters/devopsHosts.tex

@@ -36,7 +36,7 @@ only once it exists and is reachable.
 \multicolumn{4}{l}{\small\itshape Host Inventory (continued)}\\
 \toprule \textbf{Host name} & \textbf{Role} & \textbf{Platform} & \textbf{Status}\\ \midrule
 \endhead \bottomrule \endlastfoot
-\texttt{ssw590-group-web} & Group deployment target. Runs the website in \ChapterRef{CloudDockerDeployment}. & Ubuntu 26.04 LTS on Amazon EC2, \texttt{t3.micro} & In service\\
+\texttt{ssw590-group-web} & Group deployment target. Runs Color Buttons and the Gitea work hub in \ChapterRef{GiteaFoundation}; Elastic IP \texttt{100.49.80.94}. & Ubuntu 26.04 LTS on Amazon EC2, \texttt{t3.micro} & In service\\
 \texttt{ssw590-dev-01} & Primary Linux host for the course. Target for service configuration, deployment exercises, and command-line work. & Ubuntu Server LTS on Amazon EC2 & Planned\\
 \end{tabularx}
 
@@ -44,22 +44,14 @@ only once it exists and is reachable.
 \index{hosts!access model}
 \index{least privilege}
 \texttt{ssw590-group-web} is shared by both authors and runs under Victor's AWS account,
-where each author has a separate IAM identity. The following rules are the target access policy
-for course Linux hosts:
-
-\begin{itemize}[leftmargin=*]
-\item Interactive access is by \gls{ssh} public key only.
-      Password authentication is disabled in the server configuration.
-      The local account password recorded in \ChapterRef{Passwords} authenticates \texttt{sudo} only.
-\item Inbound \gls{ssh} is restricted by source address to the local workstation
-	  rather than opened to the public Internet.
-\item Day-to-day work is performed by an unprivileged account. Administrative
-      rights are granted per command rather than by general membership in the
-      \texttt{sudo} group.
-\item Teammates who require access after teams are formalized
-      receive a separate named account rather than a shared login, so that
-      access can be revoked individually and actions remain attributable.
-\end{itemize}
+where each author has a separate IAM identity. For the Gitea deployment, both authors currently connect to the Linux
+\texttt{ubuntu} account using separate public keys. Victor is a Gitea site
+administrator; Payton has a separate regular Gitea account. Linux account-level
+attribution is shared; per-person Linux accounts remain a future improvement.
+Administrative SSH is restricted to approved source IPv4 addresses. The
+observed rules and connection limitations are in \ChapterRef{GiteaFoundation}.
+This inventory does not claim that SSH password authentication or sudo policy
+was independently audited during this exercise.
 
 \section{Cost and Cleanup}
 \index{hosts!cost}
@@ -73,7 +65,6 @@ compute cost of the environment. It is therefore left unprovisioned unless
 required in the future, and would be stopped between uses rather than run continuously.
 
 Course hosts are disposable. Teardown consists of terminating the instance and
-deleting its storage volume. \texttt{ssw590-group-web} uses an automatically
-assigned public address rather than a reserved static address, so there is no
-address to release; its address changes if the instance is stopped and
-started.
+deleting its storage volume. \texttt{ssw590-group-web} uses Elastic IP \texttt{100.49.80.94}, associated on October 12, 2026.
+Release that allocation when no longer required; stopping or terminating an
+instance alone does not release the Elastic IP.

chapters/devopsIntroduction.tex

@@ -10,7 +10,8 @@ This document records the configuration of the development environment used for
 \CourseNumber\ and the working practices followed to produce it.
 Each chapter covers one subject, and each assignment adds or revises chapters
 as recorded in the document history. The latest revision for Assignment~\AssignmentNumber\
-adds \ChapterRef{CloudDockerDeployment}, \ChapterRef{LatexDocker}, and \ChapterRef{ProjectProposal}.
+adds \ChapterRef{GiteaFoundation}, recording the initial Gitea deployment
+and the pending checks required to complete the assignment.
 Earlier coursework chapters are retained.
 
 \section{Scope and Constraints}
@@ -39,7 +40,7 @@ Due date & \DueDate\\
 Instructor & \Instructor\\
 Team & \Author\\
 Board & GitHub Projects, \texttt{SSW 590} (private; captured as figures in \ChapterRef{KanbanSetup})\\
-Required deliverables & Compiled group manual; cloud deployment, LaTeX Docker exercise, tool proposal, and updated history\\
+Required deliverables & Compiled group manual with the eight Gitea rubric sections, configuration and test evidence, updated history, Hosts, and Passwords hints\\
 Team policy & Group submission\\ \bottomrule
 \end{tabularx}
 
@@ -62,6 +63,8 @@ the Template Attribution page. The template's instructional example chapter and
 its template-maintenance appendices have been removed, since they describe how
 to author the template rather than the environment this document records.
 
+\ChapterRef{GiteaFoundation} records the persistent work hub, team access, and pending domain, HTTPS, and workflow evidence.
+
 \section{Tools and AI Assistance}
 \index{AI assistance}
 AI assistance was used in preparing this document for drafting, review, and

chapters/devopsPasswords.tex

@@ -42,14 +42,17 @@ only where a generated secret cannot be retrieved.
 \multicolumn{4}{l}{\small\itshape Account, Server, and Password Rule Register (continued)}\\
 \toprule \textbf{User} & \textbf{Server or service} & \textbf{Class} & \textbf{Rule and hint}\\ \midrule
 \endhead \bottomrule \endlastfoot
+\texttt{victor} & Gitea (Inviscid) & Unique & Site administrator; password kept outside this report and repository.\\
+\texttt{payton} & Gitea (Inviscid) & Temporary & Initial password delivered separately; mandatory change configured. First-login completion pending confirmation.\\
+Both authors & EC2 \texttt{ubuntu} & SSH key & Separate private keys remain on each author's workstation; only public keys authorized on EC2. No private keys in Git.\\
 \texttt{root} & \texttt{ssw590-dev-01} & None & No password. Administrative access is obtained through \texttt{sudo} by a named account, so that privileged actions are attributable.\\
 \texttt{payton} & \texttt{ssw590-dev-01}, \texttt{ssw590-build-01} & Derived & Used only to authenticate \texttt{sudo}; \gls{ssh} password authentication is disabled, so this secret never crosses the network.
 \textit{Psst... sudo is a name, no?}\\
 \texttt{ssw-app} & \texttt{ssw590-dev-01} & Generated & Unprivileged service account for course applications. Secret held in a file readable only by that account, excluded from the repository, and rotated per deployment.\\
 Master & Password manager vault & Derived & A memorized password that isn't stored in its own vault.
 \textit{Surely it's secure, no lie?}\\
-Root user & AWS account & Generated & Reserved for account recovery and billing; \gls{mfa} enforced, not used for routine work.\\
-\texttt{payton-admin} & AWS console, \gls{iam} & Generated & Day-to-day console account. \gls{mfa} enforced. Programmatic access uses short-lived credentials rather than a stored key pair.\\
+Root user & AWS account & Generated & Existing account policy: recovery and billing. Victor previously reported administrative root use and deferred MFA; current MFA state not verified.\\
+Payton & AWS console, Identity Center & Separate identity & EC2 permission set configured previously; current MFA state not verified.\\
 \end{tabularx}
 
 \section{Handling and Storage}
@@ -60,7 +63,7 @@ The following rules apply to every entry above.
 \begin{itemize}[leftmargin=*]
 \item No password, private key, access token, or recovery code is recorded anywhere non-secure.
       A secret is referred to by the location that holds it.
-\item \gls{mfa} is enabled on every account that supports it.
+\item Target policy: enable \gls{mfa} wherever supported. This is not a claim that every current account has been verified as compliant.
 \item A generated password is rotated by replacement. Any password is
       rotated immediately if it is disclosed, and knowing one password
       does not provide insight into other passwords.

devopsAssignment.tex

@@ -38,17 +38,17 @@
 \definecolor{devopsLightBlue}{RGB}{232,240,247}
 
 % Replace these values for each assignment.
-\newcommand{\AssignmentTitle}{Cloud Docker Deployment, LaTeX Docker, and Project Proposal}
-\newcommand{\AssignmentNumber}{3}
-\newcommand{\DocumentVersion}{3.2}
+\newcommand{\AssignmentTitle}{Startup Foundation with Gitea}
+\newcommand{\AssignmentNumber}{4}
+\newcommand{\DocumentVersion}{4.0}
 \newcommand{\DocumentStatus}{Submitted Document}
 \newcommand{\CourseNumber}{SSW 590}
 \newcommand{\CourseName}{DevOps}
 \newcommand{\Author}{Payton Bates and Victor Del Rio Foces}
 \newcommand{\Instructor}{Darian Muresan, Ph.D.}
 \newcommand{\Organization}{Stevens Institute of Technology}
-\newcommand{\DocumentDate}{October 6, 2026}
-\newcommand{\DueDate}{October 6, 2026 by 11:59pm}
+\newcommand{\DocumentDate}{October 15, 2026}
+\newcommand{\DueDate}{October 15, 2026 (submission time: see Canvas)}
 \newcommand{\VERSION}{Version \DocumentVersion}
 
 \hypersetup{
@@ -124,6 +124,7 @@
 \include{chapters/devopsCloudDockerDeployment}
 \include{chapters/devopsLatexDocker}
 \include{chapters/devopsProjectProposal}
+\include{chapters/devopsGiteaFoundation}
 
 \appendix
 \include{backmatter/devopsAIPromptLog}

frontmatter/abstract.tex

@@ -9,3 +9,8 @@ on Amazon EC2, with public browser and terminal verification evidence;
 a Docker container that compiles \LaTeX\ documents as Overleaf does;
 and the Inviscid monitoring-service proposal, including a planned comparison
 of Prometheus and VictoriaMetrics.
+
+Assignment 4 records the initial persistent Gitea service on the existing EC2
+host, Elastic IP association, and separate team access. Student Pack partner
+activation, domain/DNS, final HTTPS and firewall verification, persistence
+replacement testing, and reviewed Gitea workflows remain pending in this draft.

frontmatter/devopsDocumentHistory.tex

@@ -11,6 +11,7 @@ link each entry to the changed chapter, table, figure, or controlled artifact.
 \multicolumn{4}{l}{\small\itshape Document Update History (continued)}\\
 \toprule \textbf{Date / Version} & \textbf{Author Initials} & \textbf{Change} & \textbf{Changed At}\\ \midrule
 \endhead \bottomrule \endlastfoot
+October 15, 2026 / 4.0 & VDRF & Added the initial Gitea foundation chapter with deployment, SQLite, Elastic IP, access evidence, and explicit pending DNS/HTTPS/workflow items. Updated Hosts inventory and cleanup, Passwords account/hint table and policy-versus-observation wording, metadata, abstract, introduction, and AI log. & \ChapterRef{GiteaFoundation}, \ChapterRef{Hosts}, \ChapterRef{Passwords}, \ChapterRef{AIPromptLog}\\
 October 6, 2026 / 3.2 & VDRF & Replaced the preliminary tool proposal with Inviscid, its sample customer task, tentative stack, research question, and independent SWOT assessments of Prometheus and VictoriaMetrics. Updated the abstract and AI log. & \ChapterRef{ProjectProposal}, \ChapterRef{AIPromptLog}\\
 October 5, 2026 / 3.1 & PCB & Added the LaTeX Docker chapter for compiling a sample document with its sources, build and run commands, and test evidence. Updated the document title, keywords, glossary,  abstract, introduction, and hosts. & \ChapterRef{LatexDocker}, \ChapterRef{Hosts}, \ChapterRef{Introduction}, \ChapterRef{CloudDockerDeployment}\\
 October 5, 2026 / 3.0 & VDRF & Added AWS Docker deployment, class-based website sources, execution evidence, and a draft tool-comparison proposal. Updated Assignment 3 metadata and AI log. & \ChapterRef{CloudDockerDeployment}, \ChapterRef{ProjectProposal}, \ChapterRef{AIPromptLog}\\