From 9b72a1761dfe2e865cc8ba5e081a51317480edaf Mon Sep 17 00:00:00 2001 From: jjradzz Date: Tue, 29 Sep 2026 21:06:51 +0000 Subject: [PATCH 1/6] issue-1-gitea-operations Document Gitea deployment and operations for issue #1 --- SMARTPARK_GITEA_OPERATIONS.md | 89 +++++++++++++++++++++++++++++++++++ 1 file changed, 89 insertions(+) create mode 100644 SMARTPARK_GITEA_OPERATIONS.md diff --git a/SMARTPARK_GITEA_OPERATIONS.md b/SMARTPARK_GITEA_OPERATIONS.md new file mode 100644 index 0000000..cbddfee --- /dev/null +++ b/SMARTPARK_GITEA_OPERATIONS.md @@ -0,0 +1,89 @@ +# Stevens SmartPark Gitea operations + +Status: deployed and checked on 2026-09-29. This document describes the Gitea +work hub, not a deployed SmartPark parking application. The earlier Two Buttons +site remains on the same Droplet as a separate exercise. + +## Service and architecture + +- Public work hub: https://git.137-184-97-250.nip.io/ +- Product repository: https://git.137-184-97-250.nip.io/stevens-smartpark/smartpark-app +- Host: one DigitalOcean Ubuntu 22.04 Droplet, 1 vCPU, 1 GiB RAM, 25 GiB disk. +- Gitea image: `docker.gitea.com/gitea:1.27.3`, configured with Docker Compose. +- Caddy is the public reverse proxy. The Cloud Firewall admits TCP 443 and TCP + 80 for HTTPS and HTTP-to-HTTPS redirect. SSH/TCP 22 is restricted to the + approved administrator IPv4 source. Gitea publishes no host port. +- Caddy terminates TLS and forwards privately to `gitea:3000` on Docker network + `color-net`. Gitea uses SQLite at `/data/gitea/gitea.db`; its `/data` directory + is backed by the named volume `gitea-foundation_gitea_data`. +- The `caddy_data` and `caddy_config` named volumes persist Caddy certificate + and configuration state. The live Caddyfile is mounted read-only from the + Droplet's `/root/color-buttons-app/Caddyfile`. +- The current `nip.io` hostname is a temporary address. It is **not** the + required GitHub Student Developer Pack domain offer; that requirement remains + outstanding for the team manual. + +## Start and inspect + +Sign in to the Droplet with the administrator's SSH key. Do not share the key, +passwords, tokens, or the Gitea database in the repository or report. + +```bash +cd /root/gitea-foundation +docker compose config --quiet +docker compose up -d +docker compose ps +docker logs --tail 50 gitea-foundation-gitea-1 +``` + +The expected Gitea container status is `Up`; its port listing should contain +only internal `22/tcp` and `3000/tcp`, without a host address mapping. Git over +SSH is disabled; HTTPS is the intended public access path. Check the public +repository URL in a browser and verify that the certificate is trusted. + +## Restart and troubleshoot + +```bash +cd /root/gitea-foundation +docker compose restart gitea +docker compose ps +docker logs --tail 100 gitea-foundation-gitea-1 +docker exec color-buttons-caddy wget -S -O /dev/null http://gitea:3000/ +docker exec color-buttons-caddy caddy validate --config /etc/caddy/Caddyfile +``` + +If the private `wget` check fails, inspect the Gitea logs, container status, +and `color-net` membership. If private access works but public HTTPS fails, +inspect Caddy's status and logs, its Caddyfile, the DNS lookup, and the Cloud +Firewall rules. Validate the Caddyfile before reloading it. Preserve the named +volumes when replacing containers; do not use `docker compose down -v` for a +routine restart or persistence test. + +## Verification performed + +On 2026-09-29, the team recorded the SmartPark repository and first issue, +recreated only the Gitea container with +`docker compose up -d --force-recreate gitea`, and verified that the same +repository and issue remained available over valid HTTPS afterward. This +demonstrates container-replacement persistence, **not** backup or restore. + +After moving public TCP 80 from the old app container to Caddy, independent +external checks confirmed that both Gitea and the Two Buttons site redirect +HTTP to trusted HTTPS pages. Gitea's backend TCP 3000, database TCP 5432, and +remote Docker management TCP 2375/2376 were unreachable from the test source. +An SSH connection from the approved administrator source succeeded; a separate +external check could not reach SSH. Record test source and time in the manual. + +The Gitea certificate was issued by Let's Encrypt for the temporary hostname +and was valid through 2026-12-28 UTC when checked. Caddy manages renewal and +its `/data` state persists, but a renewal test or dry run still needs to be +recorded before claiming that rubric item is complete. + +## Recovery and records + +This deployment has not yet passed a backup-and-restore test. A container +replacement leaves the data volume in place but cannot recover deleted or +corrupt volume contents. Keep a separate consistent backup of both the Gitea +application data and SQLite database, then test restoration in an isolated +instance before claiming recovery. Maintain dated, sanitized evidence in the +team manual and update this page after infrastructure changes. -- 2.54.0 From 94ad7637ae4a7ba5e87b43b176fb1f135317619f Mon Sep 17 00:00:00 2001 From: jjradzz Date: Tue, 29 Sep 2026 21:12:46 +0000 Subject: [PATCH 2/6] Update docs/gitea-operations.md --- SMARTPARK_GITEA_OPERATIONS.md => docs/gitea-operations.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename SMARTPARK_GITEA_OPERATIONS.md => docs/gitea-operations.md (100%) diff --git a/SMARTPARK_GITEA_OPERATIONS.md b/docs/gitea-operations.md similarity index 100% rename from SMARTPARK_GITEA_OPERATIONS.md rename to docs/gitea-operations.md -- 2.54.0 From d317824678a1d7e1c9eaa3495ef5639635e9e51b Mon Sep 17 00:00:00 2001 From: jjradzz Date: Tue, 29 Sep 2026 21:18:44 +0000 Subject: [PATCH 3/6] issue-1-gitea-operations Add versioned Gitea Compose configuration --- compose.yaml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 compose.yaml diff --git a/compose.yaml b/compose.yaml new file mode 100644 index 0000000..bf2bb1f --- /dev/null +++ b/compose.yaml @@ -0,0 +1,22 @@ +services: + gitea: + image: docker.gitea.com/gitea:1.27.3 + restart: unless-stopped + environment: + GITEA__database__DB_TYPE: sqlite3 + GITEA__server__DOMAIN: ${GITEA_DOMAIN:?Set GITEA_DOMAIN in .env} + GITEA__server__ROOT_URL: https://${GITEA_DOMAIN:?Set GITEA_DOMAIN in .env}/ + GITEA__server__DISABLE_SSH: "true" + GITEA__service__DISABLE_REGISTRATION: "true" + volumes: + - gitea_data:/data + networks: + - color-net + # No host ports: Caddy reaches gitea:3000 on the private Docker network. + +volumes: + gitea_data: + +networks: + color-net: + external: true -- 2.54.0 From ab15ed05f1b10cfd9f0528b599939577bbe99d94 Mon Sep 17 00:00:00 2001 From: jjradzz Date: Tue, 29 Sep 2026 21:20:03 +0000 Subject: [PATCH 4/6] Upload files to "/" Document Caddy HTTPS and redirect routes. --- Caddyfile.example | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 Caddyfile.example diff --git a/Caddyfile.example b/Caddyfile.example new file mode 100644 index 0000000..1d90609 --- /dev/null +++ b/Caddyfile.example @@ -0,0 +1,14 @@ +# Current Caddy routes on the shared Droplet, recorded 2026-09-29. +# Replace the temporary nip.io names if the team later claims its own domain. + +137-184-97-250.nip.io { + reverse_proxy color-buttons-site:3000 +} + +http://137.184.97.250 { + redir https://137-184-97-250.nip.io{uri} permanent +} + +git.137-184-97-250.nip.io { + reverse_proxy gitea:3000 +} -- 2.54.0 From 5d639aec2cfc77790edee6549f4cfebe495e3b02 Mon Sep 17 00:00:00 2001 From: jjradzz Date: Tue, 29 Sep 2026 21:21:17 +0000 Subject: [PATCH 5/6] issue-1-gitea-operations Add example Gitea hostname setting --- .env.example | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 .env.example diff --git a/.env.example b/.env.example new file mode 100644 index 0000000..a5d7ea3 --- /dev/null +++ b/.env.example @@ -0,0 +1,4 @@ +# Temporary hostname for the deadline-driven Gitea deployment. +# It resolves to the existing Droplet but does not meet the Student Pack +# domain-offer rubric item. Replace it if the team later claims a domain. +GITEA_DOMAIN=git.137-184-97-250.nip.io -- 2.54.0 From de01f8cd0f5087f395429b39cfc7163256647f67 Mon Sep 17 00:00:00 2001 From: jjradzz Date: Tue, 29 Sep 2026 22:02:56 +0000 Subject: [PATCH 6/6] Update docs/gitea-operations.md --- docs/gitea-operations.md | 32 ++++++++++++++++++++++---------- 1 file changed, 22 insertions(+), 10 deletions(-) diff --git a/docs/gitea-operations.md b/docs/gitea-operations.md index cbddfee..fbfb69d 100644 --- a/docs/gitea-operations.md +++ b/docs/gitea-operations.md @@ -71,19 +71,31 @@ After moving public TCP 80 from the old app container to Caddy, independent external checks confirmed that both Gitea and the Two Buttons site redirect HTTP to trusted HTTPS pages. Gitea's backend TCP 3000, database TCP 5432, and remote Docker management TCP 2375/2376 were unreachable from the test source. -An SSH connection from the approved administrator source succeeded; a separate -external check could not reach SSH. Record test source and time in the manual. +The DigitalOcean Cloud Firewall was then attached to the correct Droplet; +screenshots show its inbound rules and Droplet assignment. After attachment, +the approved administrator completed a fresh SSH login, public HTTP redirected +to working HTTPS, and external checks found TCP 3000 and 5432 unreachable. +An unapproved-source SSH denial was not retested after attachment. Record the +test sources and times in the manual. The Gitea certificate was issued by Let's Encrypt for the temporary hostname and was valid through 2026-12-28 UTC when checked. Caddy manages renewal and -its `/data` state persists, but a renewal test or dry run still needs to be -recorded before claiming that rubric item is complete. +its `/data` state persists. A separate staging-CA hostname successfully +completed an ACME issuance dry run on 2026-09-29; it returned HTTP 200 with a +matching staging certificate. The staging route was then removed and both +live HTTPS sites were rechecked. This proves the ACME challenge and issuance +path works; it does not claim an observed renewal of the live certificate. ## Recovery and records -This deployment has not yet passed a backup-and-restore test. A container -replacement leaves the data volume in place but cannot recover deleted or -corrupt volume contents. Keep a separate consistent backup of both the Gitea -application data and SQLite database, then test restoration in an isolated -instance before claiming recovery. Maintain dated, sanitized evidence in the -team manual and update this page after infrastructure changes. +A container replacement leaves the data volume in place but cannot recover +deleted or corrupt volume contents. On 2026-09-29, the operator briefly stopped +Gitea and archived the entire named data volume, including SQLite, application +configuration, and Git repositories. Gitea restarted normally. The archive was +restored into a separate volume and Gitea instance bound only to Droplet +localhost. The restored test repository and issue returned HTTP 200; the issue +retained its unique marker, and the restored Git endpoint returned the expected +commit. Original and restored browser screenshots were recorded. The backup +archive contains secrets and remains root-only on the Droplet; do not publish +it. Maintain dated, sanitized evidence in the team manual and update this page +after infrastructure changes. \ No newline at end of file -- 2.54.0