🚀 Gitea Infrastructure on AWS

📋 Table of Contents

• 🧩 Infrastructure Components
• 🔧 Application Details
• ✨ Key Features
• 🚀 Quick Start
• 📊 Monitoring
• 🔒 Security

🧩 Infrastructure Components

🐳 Container Orchestration

💾 Storage & Database

🔐 Security & Configuration

AWS Systems Manager Parameter Store

Centralized, encrypted storage for:

• Database credentials
• API keys and secrets
• Application configuration
• Environment variables

🌐 Load Balancing & SSL

Traffic Flow:
Internet → Route 53 → Application Load Balancer → ECS Containers
         ↓
    SSL Certificate (ACM) → HTTPS Encryption

• Application Load Balancer: Health checks, traffic distribution
• AWS Certificate Manager: Automated SSL certificate management
• Route 53: DNS management with failover capabilities

⚙️ CI/CD Pipeline

🔧 Application Details

🦊 Gitea Configuration

Runtime Environment:
  Platform: ECS Fargate
  Port: 3000 (HTTP)
  Database: PostgreSQL with SSL
  Storage: EFS mounted at /data
  Authentication: Parameter Store secrets
  
Features:
  ✅ Git over HTTPS
  ✅ Web interface
  ✅ Issue tracking
  ✅ Pull requests
  ✅ SSH 

🔨 Jenkins Configuration

Infrastructure:
  Instance: EC2 t3.medium (Ubuntu 22.04)
  Container: Jenkins LTS in Docker
  Backup: Automated daily S3 sync
  
Capabilities:
  ✅ Docker-in-Docker builds
  ✅ ECR integration
  ✅ AWS CLI access
  ✅ Automatic restoration

✨ Key Features

🚀 Quick Start

Prerequisites

# Required tools
terraform --version  # >= 1.0
aws --version        # AWS CLI configured

Deployment Steps

cd jenkins-s3/
terraform init
terraform plan
terraform apply

cd ../gitea/
terraform init
terraform plan
terraform apply
# Note: Creates ECR, ECS, EFS, RDS, IAM roles

cd ../gitea-alb/
terraform init
terraform plan
terraform apply
# Outputs: DNS name and HTTPS URL

cd ../jenkins-ec2/
terraform init
terraform plan
terraform apply
# Outputs: Jenkins URL and SSH command

🎉 Access Your Services

📊 Monitoring

CloudWatch Integration

Monitoring Stack:
  📈 Container Insights: ECS cluster metrics
  📋 Log Groups: Centralized application logs  
  🚨 Health Checks: ALB target health monitoring
  📊 Custom Metrics: Database performance insights

Key Metrics to Watch

• ECS service CPU/Memory utilization
• RDS connection count and query performance
• EFS throughput and IOPS
• ALB response times and error rates

🔒 Security

🛡️ Security Best Practices Implemented

🔐 Secrets Management

All sensitive data is stored in AWS Systems Manager Parameter Store:

• Database credentials (encrypted)
• Application secrets and API keys
• SSL certificates and domain configuration

This infrastructure project provisions a complete AWS-based environment for running Gitea (a self-hosted Git service) and Jenkins (a CI/CD automation server) using Terraform. It includes container orchestration, persistent storage, secret management, backups, and secure public access via HTTPS.

🗂️ Components Overview

🚀 Gitea Deployment (ECS + Fargate)

• Gitea runs inside a container defined in task-definition.json, hosted on ECS Fargate.
• Application data is mounted via EFS, ensuring persistent /data.
• Secrets like DB credentials and admin account info are securely pulled from SSM Parameter Store.
• Public access is managed via Application Load Balancer (ALB) with:
  • Automatic HTTP → HTTPS redirection
  • Self-signed SSL certificate provisioned via ACM
  • Domain mapping via Route 53

🔧 Jenkins Deployment (EC2 + Docker)

• Jenkins runs in a Docker container on an EC2 instance, provisioned with:
  • SSH access
  • Docker and AWS CLI pre-installed
  • Automatic restore from S3 if backup is available
• Daily backups are uploaded to S3, versioned and encrypted
• EC2 instance uses an IAM role with permissions to read/write S3 and access ECR

🔐 Secrets Management (Parameter Store)

Secrets are stored under /gitea/ namespace and injected into the Gitea container at runtime:

• Database host, user, password
• Admin username, password, email
• Security keys (e.g. SECRET_KEY, INSTALL_LOCK)

📦 S3 Usage

• Bucket: my-jenkins-storage
• Used to store and version Jenkins backup data
• Public access is fully blocked
• Server-side encryption is enforced with AES256

📌 Additional Notes

• All services are deployed in us-east-1
• Default VPC and subnets are used for quick setup
• Jenkins can be accessed at [http://<EC2_PUBLIC_IP>:8080](http://jenkins-gitea.pp.ua:8080
• Gitea is available at https://my-gitea.pp.ua