Merge pull request 'Add repo README, update Gitea README, add Caddy HTTPS proxy' (#7) from payton/caddy-https into main

Reviewed-on: http://localhost:3000/Inviscid/SSW590-DevOps/pulls/7
Reviewed-by: victor <vdelriof@stevens.edu>

README.md

@@ -0,0 +1,58 @@
+# Inviscid
+
+Inviscid is a proposed startup that helps small businesses monitor the health
+and performance of their web applications. Customers would use a dashboard to
+see availability, response times, request volume, and error rates, paired with
+plain-language status summaries such as "Your website is responding slowly."
+
+The semester prototype targets one demonstration customer application, building
+on the team's existing Node.js website. Monitoring, the dashboard,
+and deployment automation are **planned work, not completed features**. See the
+Project Proposal chapter of the manual for the full plan and the Prometheus vs.
+VictoriaMetrics comparison.
+
+## Repository contents
+
+| Path | Contents |
+|---|---|
+| `devopsAssignment.tex`, `chapters/`, `frontmatter/`, `backmatter/`, `figures/` | The team's LaTeX DevOps IT manual (SSW 590) |
+| `docker/gitea/` | Versioned deployment files for the Gitea work hub (Compose, Caddyfile, deployment README) |
+| `docker/color-buttons/` | Color Buttons demonstration app (Node.js/Express, Dockerfile) |
+| `docker/latex-compiler/` | Docker image for compiling the manual |
+
+## Links
+
+- Gitea work hub: <https://git.inviscid.dev/>
+- This repository: <https://git.inviscid.dev/Inviscid/SSW590-DevOps>
+- Deployment documentation: [`docker/gitea/README.md`](docker/gitea/README.md)
+
+## Building the manual
+
+The manual uses `minted`, which needs shell escape and the `latexminted`
+helper. Overleaf compiles it as-is. Locally:
+
+```sh
+latexmk -pdf devopsAssignment.tex
+```
+
+`latexmkrc` enables `-shell-escape` and runs `makeglossaries` automatically.
+
+## Team
+
+| Member | Gitea account | Role |
+|---|---|---|
+| Victor | `victor` | Organization owner; site administrator; domain, DNS, and Gitea deployment |
+| Payton | `payton` | Organization owner; HTTPS, firewall, persistence testing, repository workflow |
+
+## Workflow
+
+1. Open an issue with a short description and acceptance criteria.
+2. Create a branch from `main`.
+3. Open a pull request into `main` and reference the issue with `Closes #N`.
+4. Request a review from the other team member; merge only after approval.
+5. Confirm the linked issue closed.
+
+## Secrets
+
+Never commit passwords, tokens, private keys, `app.ini`, database files, or
+volume contents. The manual's Passwords table contains hints only.

docker/gitea/Caddyfile

@@ -0,0 +1,7 @@
+git.inviscid.dev {
+	reverse_proxy gitea:3000
+}
+
+http://100.49.80.94, http://ec2-100-49-80-94.compute-1.amazonaws.com {
+	reverse_proxy ssw590-group-buttons:3000
+}

docker/gitea/README.md

@@ -1,13 +1,16 @@
 # Inviscid Gitea foundation
 
-This is the temporary, Gitea-only deployment used before the domain was registered; retain it as the initial deployment configuration.
-The official image version is pinned; verify that it pulls before starting the service.
+This directory deploys Gitea at https://git.inviscid.dev/ behind a Caddy reverse proxy.
+The official image version is pinned.
 SQLite is `/data/gitea/gitea.db`; repositories and other application data share the
-persistent named volume `inviscid_gitea_data`. Container replacement must preserve it.
+persistent named volume `inviscid_gitea_data`.
 Never run `docker compose down --volumes` against the working service.
 
-Only EC2 loopback port 3000 is published. Initial browser access uses an SSH tunnel.
-The existing Color Buttons container remains unchanged on port 80.
+Only Caddy publishes host ports (80 and 443). Caddy terminates TLS and forwards to
+`gitea:3000` over the private `inviscid_services` network. Gitea's port 3000 is also
+bound to EC2 loopback only, for SSH-tunnel administration.
+The Color Buttons container (`ssw590-group-buttons`) no longer publishes port 80; it
+runs on `inviscid_services` and Caddy serves it at http://100.49.80.94.
 No public backend or Git SSH firewall rule is needed.
 
 From this directory on EC2:
@@ -19,30 +22,18 @@ sudo docker compose up -d
 sudo docker compose ps
 ```
 
-This initial configuration is NOT the final hostname-based HTTPS deployment.
-After domain registration, replace DOMAIN and ROOT_URL with the actual hostname
-and HTTPS URL. Payton can attach Caddy to `inviscid_services` and forward to
-`gitea:3000`, publish the proxy web ports, persist certificate state, and resolve
-the existing website's port-80 mapping. Remove the loopback mapping if no longer needed.
+`Caddyfile` must be in this directory before `up`; if it is missing, Docker creates a
+directory in its place and Caddy fails to start. Caddy obtains and renews the
+Let's Encrypt certificate automatically; certificate state persists in the
+`inviscid_caddy_data` and `inviscid_caddy_config` volumes.
 
-Self-registration is disabled. Create the initial administrator through the installer;
-create Payton's separate account using administration after initialization.
-Keep passwords, app.ini, database files, and volume contents out of Git and screenshots.
+The Color Buttons container is managed outside Compose. To recreate it without a
+published port:
 
-Sources:
-- https://docs.gitea.com/installation/install-with-docker/
-- https://docs.gitea.com/administration/config-cheat-sheet/
-
-## Recorded deployment (October 12, 2026)
-
-- EC2: `ssw590-group-web`, `i-025a57432604c8d4b`, us-east-1.
-- Current public Elastic IP: `100.49.80.94` (replaces `54.221.175.174`).
-- Remote configuration directory: `/home/ubuntu/gitea`.
-- Observed image digest: `docker.gitea.com/gitea@sha256:f505a0d3a41323b786e05942fc7a4075e07ae7c169fd9485649aa55ee543a21a`.
-- Gitea initialized with site title Inviscid; victor is administrator and payton is a regular user.
-- Local HTTP check returned 200; named-volume mount and SQLite file were verified.
-- Both containers remained running following Elastic IP association.
-- This October 12 configuration predates domain registration; see the October 15 update below.
+```sh
+sudo docker run -d --name ssw590-group-buttons --restart unless-stopped \
+  --network inviscid_services ssw590-group-buttons
+```
 
 For private browser access, use your own authorized key:
 
@@ -53,20 +44,10 @@ ssh -i /path/to/your-private-key -o ExitOnForwardFailure=yes -N -L 127.0.0.1:300
 Open http://localhost:3000 while the tunnel stays open. Each team member must
 have their public key authorized and their source IP allowed for administrative SSH.
 
-## October 15 handoff update
+Keep passwords, app.ini, database files, and volume contents out of Git and screenshots.
 
-- Student Pack domain offer redeemed: `inviscid.dev`, Name.com, one year at $0.00.
-- Displayed renewal: October 15, 2027 at $22.99; auto-renew enabled. Victor owns renewal.
-- Saved A record: `git.inviscid.dev` -> `100.49.80.94`, TTL 300.
-- Windows lookups via 1.1.1.1 and 8.8.8.8 both returned that IP at 19:17 EDT.
-- Both users are organization owners of `Inviscid`; Payton's SSH/Gitea access works per Victor.
-- Existing main history pushed to `Inviscid/SSW590-DevOps`; issue #1 and PR #2 created.
-- PR #2 (`da6a369`, `codex/gitea-foundation-docs`) awaits Payton's review and merge.
-- Payton owns the remaining Gitea tasks; Victor will review his separate PR.
-- Public HTTPS, renewal tests, external exposure, container replacement persistence,
-  README/five-issue completion, and two completed reviewed PR workflows are not yet verified.
-
-Payton: update DOMAIN to `git.inviscid.dev` and ROOT_URL to
-`https://git.inviscid.dev/` alongside Caddy configuration. The tracked Compose
-file still intentionally records the initial localhost setup; do not interpret
-the new DNS record as proof that HTTPS has been deployed.
+Sources:
+- https://docs.gitea.com/installation/install-with-docker/
+- https://docs.gitea.com/administration/config-cheat-sheet/
+- https://caddyserver.com/docs/running#docker-compose
+- https://caddyserver.com/docs/automatic-https

docker/gitea/compose.yaml

@@ -9,9 +9,8 @@ services:
       USER_GID: "1000"
       GITEA__database__DB_TYPE: sqlite3
       GITEA__database__PATH: /data/gitea/gitea.db
-      # Temporary URLs for SSH-tunnel initialization; replace after registration.
-      GITEA__server__DOMAIN: localhost
-      GITEA__server__ROOT_URL: http://localhost:3000/
+      GITEA__server__DOMAIN: git.inviscid.dev
+      GITEA__server__ROOT_URL: https://git.inviscid.dev/
       GITEA__server__HTTP_PORT: "3000"
       GITEA__server__DISABLE_SSH: "true"
       GITEA__service__DISABLE_REGISTRATION: "true"
@@ -22,9 +21,28 @@ services:
     networks:
       - services
 
+  caddy:
+    image: caddy:2.10.2
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
+    networks:
+      - services
+    depends_on:
+      - gitea
+
 volumes:
   gitea_data:
     name: inviscid_gitea_data
+  caddy_data:
+    name: inviscid_caddy_data
+  caddy_config:
+    name: inviscid_caddy_config
 
 networks:
   services: