Project Control

Continue prompt

{
  "project": "gitea",
  "mission": "Operate and maintain the VM101 internal Gitea server (v1.27.0 on container port 3000, mapped to host port 3001 and SSH port 2222, backed by PostgreSQL on the iiot_iiot network), ensuring high availability for all internal fleet repositories, performing periodic data backups and image updates, and managing token lifecycle.",
  "read_first": [
    "/data/vault/wiki/projects/gitea.md",
    "output/census-latest.json",
    "/data/vault/wiki/hot.md",
    "/data/vault/wiki/log.md",
    "/data/vault/wiki/projects/_index.md"
  ],
  "verification_anchor": {
    "command": "curl -s http://192.168.1.201:3001/api/v1/version && echo '' && docker ps --filter \"name=gitea\" --format \"table {{.Names}}\t{{.Status}}\t{{.Ports}}\"",
    "expect": "{\"version\":\"1.27.0\"} and 1 active container named gitea (Up, ports 0.0.0.0:2222->22/tcp and 0.0.0.0:3001->3000/tcp)"
  },
  "project_context": {
    "what_it_is": "Self-hosted Gitea 1.27.0 Git service running on VM101 in Docker, serving as the central, private source-of-truth repository host for all SMS internal IT projects and agent workspaces (including agents-switching, dv-obsidian-vault, project-control, doc-control-clean, project-fin-control, Proxmox, and PJT2-W4-SCADA).",
    "domain_notes": "Gitea runs containerized on VM101 (192.168.1.201), mapped to host port 3001 (because Grafana occupies port 3000 on VM101) and SSH port 2222. External access is routed through Proxmox DNAT (:3000 -> 192.168.1.201:3001 for web and :2222 -> 192.168.1.201:2222 for SSH). It attaches to the iiot_iiot Docker bridge network to communicate with PostgreSQL (postgres:5432 with DB gitea, user gitea). Gitea is intentionally kept private (not exposed via Tailscale Funnel) and stores repository and application state in bind-mounted /opt/gitea/data on the VM101 host."
  },
  "tech_stack": {
    "application": "Gitea 1.27.0 (Docker image gitea/gitea:latest)",
    "database": "PostgreSQL 16 (shared container postgres:5432 on iiot_iiot network; database: gitea, user: gitea)",
    "host_runtime": "Docker on VM101 (Ubuntu Linux, 192.168.1.201)",
    "networking_and_ports": "Container ports 3000 (HTTP) and 22 (SSH) mapped to VM101 host ports 3001 and 2222; Proxmox DNAT exposes :3000 (web) and :2222 (SSH) on ZeroTier/Tailscale",
    "storage": "Host bind mount at /opt/gitea/data mapped to /data in container"
  },
  "current_state": {
    "summary": "Gitea service container is healthy and actively running on VM101 (Up 6 days). Hosting 7 fleet repositories (SINERGI/PJT2-W4-SCADA, SINERGI/Proxmox, dimas/agents-switching, SINERGI/doc-control-clean, dimas/dv-obsidian-vault, dimas/project-control, SINERGI/project-fin-control). Successfully migrated from SQLite to PostgreSQL backend. VM101 Gitea is primary source-of-truth across all sandboxes; dead legacy remote (172.24.0.2:8070) is retired.",
    "source_of_this_status": "output/census-latest.json (containers, opt_deployments, gitea_repos) + vault pages /data/vault/wiki/projects/gitea.md, /data/vault/wiki/hot.md, and /data/vault/wiki/log.md (§2026-08-20 & §2026-08-25)"
  },
  "repo_locations": {
    "web_ui_zerotier": "http://10.241.131.219:3000 (Proxmox DNAT → VM101 :3001)",
    "web_ui_internal": "http://192.168.1.201:3001 or http://localhost:3001 from VM101 host",
    "ssh_remote_tailscale": "ssh://git@100.111.179.81:2222 (recommended for direct git SSH operations)",
    "ssh_remote_zerotier": "ssh://git@10.241.131.219:2222",
    "vm101_host_storage": "/opt/gitea/data (untracked host directory mounted to /data in container)",
    "windows_local_config": "C:\\Users\\dimas\\OneDrive - Business\\SMS\\Internal\\server\\gitea\\",
    "local_clone": "none (infrastructure service deployment with no separate application source git repository)"
  },
  "key_files": {
    "/data/vault/wiki/projects/gitea.md": "Obsidian wiki note detailing Gitea infrastructure architecture, database configuration, port mappings, and operational CLI runbooks",
    "/opt/gitea/data": "VM101 host bind-mounted directory containing Gitea configuration (app.ini), repositories storage, and SSH keys",
    "C:\\Users\\dimas\\OneDrive - Business\\SMS\\Internal\\server\\gitea\\": "Windows host local backup directory storing Gitea configuration and container run commands",
    "C:\\pjt2-scada\\vm101_ssh.py": "Windows Python 3.12 helper script for remote VM101 SSH execution and container management",
    "/home/ubuntu/.ssh/id_gitea": "Host-side deploy key for authenticated Git push/pull operations against VM101 Gitea"
  },
  "next_steps": [
    "Monitor container health and PostgreSQL connectivity on VM101 (`docker ps --filter name=gitea`).",
    "Perform periodic data directory backups before any container image upgrade: `cp -r /opt/gitea/data /opt/gitea/data.bak-$(date +%F)` on VM101 host.",
    "Revoke expired temporary API token `project-control-repo-create-temp` manually via Gitea Web UI (identified in hot.md cleanup backlog).",
    "Verify that all agent sandboxes and background timer jobs (vault-sync.timer, project-control.timer) maintain functional push/pull access to their respective repositories.",
    "Maintain Gitea privacy invariant: keep Gitea on internal network and Proxmox DNAT without exposing it to public Tailscale Funnel endpoints."
  ],
  "constraints": [
    "Never run `docker prune` on VM101 — 13 production SCADA containers and the agent fleet are co-tenant on this host.",
    "Do not stop or remove the postgres container on VM101 — Gitea relies directly on the PostgreSQL gitea database over iiot_iiot network.",
    "Do not expose Gitea to public Tailscale Funnel: Gitea contains private company source code and must remain restricted to internal LAN, ZeroTier, and authenticated Tailscale access.",
    "Port conflict rule: Gitea container HTTP port 3000 must remain mapped to host port 3001 (Grafana occupies host port 3000).",
    "Always create a data snapshot (`cp -r /opt/gitea/data /opt/gitea/data.bak-...`) before upgrading the gitea/gitea:latest image.",
    "Do not hardcode or commit Gitea database passwords or personal SSH private keys (~/.ssh/*) into repositories or public wiki pages."
  ],
  "known_staleness_warning": "The vault page (/data/vault/wiki/projects/gitea.md) was created on 2026-07-16 and lists ZeroTier IP http://10.241.131.219:3000 as the primary remote URL, whereas direct operations from sandboxes/host use VM101 LAN IP http://192.168.1.201:3001 (or Tailscale IP 100.111.179.81:2222 for git SSH, established on 2026-08-20). The page also does not list newer repos created in August 2026 (such as dimas/project-control, dimas/agents-switching, and SINERGI/Proxmox).",
  "handoff_metadata": {
    "created": "2026-08-25",
    "created_by": "project-control automated continue-prompt generator",
    "all_facts_sourced_from": "census-latest.json + /data/vault/wiki/projects/gitea.md + /data/vault/wiki/hot.md + /data/vault/wiki/log.md + /data/vault/wiki/projects/_index.md"
  }
}

Detail

Observed Signals

Containers: gitea (gitea/gitea:latest, Up 6 days, ports 0.0.0.0:2222->22/tcp, 0.0.0.0:3001->3000/tcp).
Deployments: /opt/gitea (last_touched_iso: null).
Git Repos & Local Clones: Central host for all internal fleet repositories (SINERGI/PJT2-W4-SCADA, SINERGI/Proxmox, dimas/agents-switching, SINERGI/doc-control-clean, dimas/dv-obsidian-vault, dimas/project-control, SINERGI/project-fin-control).
Vault Documentation: gitea.md (status: active, updated 2026-07-16).

1. What's Left

Routine core service operation, periodic container version upgrades, and regular backup verification. No pending application development features observable.

2. Continue / Drop Suggestion

Continue — Indispensable fleet infrastructure service hosting all internal git repositories.

3. Dynamic Milestone Estimate

Delivery Window: 2–4 weeks for scheduled maintenance and backup verification audit.
Confidence: Low (controller estimate, revised 2026-08-25; steady-state infrastructure service with null touch mtime).