# Inviscid Gitea foundation

This is the temporary, Gitea-only deployment used before the domain was registered; retain it as the initial deployment configuration.
The official image version is pinned; verify that it pulls before starting the service.
SQLite is `/data/gitea/gitea.db`; repositories and other application data share the
persistent named volume `inviscid_gitea_data`. Container replacement must preserve it.
Never run `docker compose down --volumes` against the working service.

Only EC2 loopback port 3000 is published. Initial browser access uses an SSH tunnel.
The existing Color Buttons container remains unchanged on port 80.
No public backend or Git SSH firewall rule is needed.

From this directory on EC2:

```sh
sudo docker compose config --quiet
sudo docker compose pull
sudo docker compose up -d
sudo docker compose ps
```

This initial configuration is NOT the final hostname-based HTTPS deployment.
After domain registration, replace DOMAIN and ROOT_URL with the actual hostname
and HTTPS URL. Payton can attach Caddy to `inviscid_services` and forward to
`gitea:3000`, publish the proxy web ports, persist certificate state, and resolve
the existing website's port-80 mapping. Remove the loopback mapping if no longer needed.

Self-registration is disabled. Create the initial administrator through the installer;
create Payton's separate account using administration after initialization.
Keep passwords, app.ini, database files, and volume contents out of Git and screenshots.

Sources:
- https://docs.gitea.com/installation/install-with-docker/
- https://docs.gitea.com/administration/config-cheat-sheet/

## Recorded deployment (October 12, 2026)

- EC2: `ssw590-group-web`, `i-025a57432604c8d4b`, us-east-1.
- Current public Elastic IP: `100.49.80.94` (replaces `54.221.175.174`).
- Remote configuration directory: `/home/ubuntu/gitea`.
- Observed image digest: `docker.gitea.com/gitea@sha256:f505a0d3a41323b786e05942fc7a4075e07ae7c169fd9485649aa55ee543a21a`.
- Gitea initialized with site title Inviscid; victor is administrator and payton is a regular user.
- Local HTTP check returned 200; named-volume mount and SQLite file were verified.
- Both containers remained running following Elastic IP association.
- This October 12 configuration predates domain registration; see the October 15 update below.

For private browser access, use your own authorized key:

```sh
ssh -i /path/to/your-private-key -o ExitOnForwardFailure=yes -N -L 127.0.0.1:3000:127.0.0.1:3000 ubuntu@100.49.80.94
```

Open http://localhost:3000 while the tunnel stays open. Each team member must
have their public key authorized and their source IP allowed for administrative SSH.

## October 15 handoff update

- Student Pack domain offer redeemed: `inviscid.dev`, Name.com, one year at $0.00.
- Displayed renewal: October 15, 2027 at $22.99; auto-renew enabled. Victor owns renewal.
- Saved A record: `git.inviscid.dev` -> `100.49.80.94`, TTL 300.
- Windows lookups via 1.1.1.1 and 8.8.8.8 both returned that IP at 19:17 EDT.
- Both users are organization owners of `Inviscid`; Payton's SSH/Gitea access works per Victor.
- Existing main history pushed to `Inviscid/SSW590-DevOps`; issue #1 and PR #2 created.
- PR #2 (`da6a369`, `codex/gitea-foundation-docs`) awaits Payton's review and merge.
- Payton owns the remaining Gitea tasks; Victor will review his separate PR.
- Public HTTPS, renewal tests, external exposure, container replacement persistence,
  README/five-issue completion, and two completed reviewed PR workflows are not yet verified.

Payton: update DOMAIN to `git.inviscid.dev` and ROOT_URL to
`https://git.inviscid.dev/` alongside Caddy configuration. The tracked Compose
file still intentionally records the initial localhost setup; do not interpret
the new DNS record as proof that HTTPS has been deployed.