Stevens SmartPark Gitea operations

Status: deployed and checked on 2026-09-29. This document describes the Gitea work hub, not a deployed SmartPark parking application. The earlier Two Buttons site remains on the same Droplet as a separate exercise.

Service and architecture

Public work hub: https://git.137-184-97-250.nip.io/
Product repository: https://git.137-184-97-250.nip.io/stevens-smartpark/smartpark-app
Host: one DigitalOcean Ubuntu 22.04 Droplet, 1 vCPU, 1 GiB RAM, 25 GiB disk.
Gitea image: docker.gitea.com/gitea:1.27.3, configured with Docker Compose.
Caddy is the public reverse proxy. The Cloud Firewall admits TCP 443 and TCP 80 for HTTPS and HTTP-to-HTTPS redirect. SSH/TCP 22 is restricted to the approved administrator IPv4 source. Gitea publishes no host port.
Caddy terminates TLS and forwards privately to gitea:3000 on Docker network color-net. Gitea uses SQLite at /data/gitea/gitea.db; its /data directory is backed by the named volume gitea-foundation_gitea_data.
The caddy_data and caddy_config named volumes persist Caddy certificate and configuration state. The live Caddyfile is mounted read-only from the Droplet's /root/color-buttons-app/Caddyfile.
The current nip.io hostname is a temporary address. It is not the required GitHub Student Developer Pack domain offer; that requirement remains outstanding for the team manual.

Start and inspect

Sign in to the Droplet with the administrator's SSH key. Do not share the key, passwords, tokens, or the Gitea database in the repository or report.

cd /root/gitea-foundation
docker compose config --quiet
docker compose up -d
docker compose ps
docker logs --tail 50 gitea-foundation-gitea-1

The expected Gitea container status is Up; its port listing should contain only internal 22/tcp and 3000/tcp, without a host address mapping. Git over SSH is disabled; HTTPS is the intended public access path. Check the public repository URL in a browser and verify that the certificate is trusted.

Restart and troubleshoot

cd /root/gitea-foundation
docker compose restart gitea
docker compose ps
docker logs --tail 100 gitea-foundation-gitea-1
docker exec color-buttons-caddy wget -S -O /dev/null http://gitea:3000/
docker exec color-buttons-caddy caddy validate --config /etc/caddy/Caddyfile

If the private wget check fails, inspect the Gitea logs, container status, and color-net membership. If private access works but public HTTPS fails, inspect Caddy's status and logs, its Caddyfile, the DNS lookup, and the Cloud Firewall rules. Validate the Caddyfile before reloading it. Preserve the named volumes when replacing containers; do not use docker compose down -v for a routine restart or persistence test.

Verification performed

On 2026-09-29, the team recorded the SmartPark repository and first issue, recreated only the Gitea container with docker compose up -d --force-recreate gitea, and verified that the same repository and issue remained available over valid HTTPS afterward. This demonstrates container-replacement persistence, not backup or restore.

After moving public TCP 80 from the old app container to Caddy, independent external checks confirmed that both Gitea and the Two Buttons site redirect HTTP to trusted HTTPS pages. Gitea's backend TCP 3000, database TCP 5432, and remote Docker management TCP 2375/2376 were unreachable from the test source. The DigitalOcean Cloud Firewall was then attached to the correct Droplet; screenshots show its inbound rules and Droplet assignment. After attachment, the approved administrator completed a fresh SSH login, public HTTP redirected to working HTTPS, and external checks found TCP 3000 and 5432 unreachable. An unapproved-source SSH denial was not retested after attachment. Record the test sources and times in the manual.

The Gitea certificate was issued by Let's Encrypt for the temporary hostname and was valid through 2026-12-28 UTC when checked. Caddy manages renewal and its /data state persists. A separate staging-CA hostname successfully completed an ACME issuance dry run on 2026-09-29; it returned HTTP 200 with a matching staging certificate. The staging route was then removed and both live HTTPS sites were rechecked. This proves the ACME challenge and issuance path works; it does not claim an observed renewal of the live certificate.

Recovery and records

A container replacement leaves the data volume in place but cannot recover deleted or corrupt volume contents. On 2026-09-29, the operator briefly stopped Gitea and archived the entire named data volume, including SQLite, application configuration, and Git repositories. Gitea restarted normally. The archive was restored into a separate volume and Gitea instance bound only to Droplet localhost. The restored test repository and issue returned HTTP 200; the issue retained its unique marker, and the restored Git endpoint returned the expected commit. Original and restored browser screenshots were recorded. The backup archive contains secrets and remains root-only on the Droplet; do not publish it. Maintain dated, sanitized evidence in the team manual and update this page after infrastructure changes.

5.1 KiB Raw Blame History