# Runbook

## Daily checks

```bash
docker compose ps
docker compose logs --since 1h --tail 100
./verify.sh
```

## Common problems

**Gitea first login.** The first user to register becomes the administrator.
Register immediately after first boot, then disable open registration in the
admin panel.

**Woodpecker needs a shared secret.** The server and the git host must agree on
an OAuth client. Create the OAuth app in Gitea and put the client id and secret
in `.env`, or agents will not connect.

**act needs Docker access.** It runs workflows in containers, so it needs the
Docker socket. Do not run it on a shared host with untrusted workflows.

**Trivy database download.** The first scan pulls the vulnerability database and
can be slow. Run it once at setup, not inside a tight CI timeout.

**KICS false positives.** Start with the queries relevant to your stack
(`-t Terraform,Kubernetes`) rather than the full set.

**Gitness and Gitea ports.** Both default to similar ports; the compose file
maps Gitness to 3001 to avoid a clash.

## Backups

```bash
docker run --rm -v anvil_gitea_data:/data -v "$PWD":/backup \
  alpine tar czf /backup/gitea-$(date +%F).tgz -C /data .
```

Stop the service before backing up.

## Sizing

| Setup | Minimum |
|---|---|
| Git hosting | 2 GB RAM |
| Adding CI | 4 GB RAM |
| Adding scanning and platform | 8 GB RAM |

## Services in this tier

- `gitea`
- `gitness`
- `woodpecker`
- `semaphore`