CTAO Science Portal: static Astro site with git-based CMS (Sveltia + Gitea)

Portal code only; editorial content lives in the ctao/content repo on the
demo machine's Gitea and is overlaid at build time (see README.md and
deploy/README.md). Live demo: https://astro.isl-dev.grid.cyfronet.pl

deploy/ctao-demo-gitea.container

@@ -0,0 +1,62 @@
+# CTAO portal demo — Gitea (CMS backend: content repo, editor accounts, OAuth for Sveltia)
+# Quadlet unit. Install: copy to ~/.config/containers/systemd/ on the machine,
+# then `systemctl --user daemon-reload` → service name: ctao-demo-gitea.service.
+# Rootless image + SQLite by design: one container, no DB server, all state
+# lives in ~/ctao-portal-demo/gitea-{data,config} — nothing else on the machine.
+
+[Unit]
+Description=CTAO portal demo — Gitea
+Wants=network-online.target
+After=network-online.target
+
+[Container]
+ContainerName=ctao-demo-gitea
+# Pinned by digest at install (2026-07-28); tag kept for readability.
+Image=docker.io/gitea/gitea:1.27-rootless@sha256:36cce26be71609091e1236d5b5de2c66a81fb8a7d45756a5fd3b7a28c11733b7
+# The rootless image runs as uid 1000 inside; keep-id maps it to the host user
+# so the bind-mounted dirs stay owned by `strapi` (no chown, no root anywhere).
+UserNS=keep-id:uid=1000,gid=1000
+# Networking: default rootless pasta (userspace — the machine's kernel lacks
+# ip_tables for rootless netavark bridges, and we have no sudo). The build
+# container joins THIS container's netns (--network=container:ctao-demo-gitea),
+# so it sees Gitea on localhost:3000 while the HOST loopback stays invisible.
+Volume=%h/ctao-portal-demo/gitea-data:/var/lib/gitea:Z
+Volume=%h/ctao-portal-demo/gitea-config:/etc/gitea:Z
+# Bound on all interfaces DELIBERATELY: the ingress that terminates the
+# public vhost runs on a separate box and reaches this VM over the network —
+# a 127.0.0.1 bind would cut it off.
+PublishPort=3000:3000
+
+# Env-driven config — re-applied on every start, no hand-edited app.ini
+# (see .skills/gitea/SKILL.md). Secrets: none here; the admin account is
+# created interactively after first start (README).
+Environment=GITEA__server__HTTP_PORT=3000
+# Public URL via the Cyfronet ingress vhost.
+Environment=GITEA__server__ROOT_URL=https://astro-git.isl-dev.grid.cyfronet.pl/
+Environment=GITEA__server__DISABLE_SSH=true
+Environment=GITEA__database__DB_TYPE=sqlite3
+Environment=GITEA__security__INSTALL_LOCK=true
+Environment=GITEA__service__DISABLE_REGISTRATION=true
+Environment=GITEA__mailer__ENABLED=false
+# Repos default to public so the build pipeline can clone anonymously —
+# content is the public site anyway. The `ctao/portal` repo itself is
+# created in the UI (README step 7).
+Environment=GITEA__repository__DEFAULT_PRIVATE=public
+# Sveltia is served from the portal vhost and calls the Gitea API cross-origin
+# — CORS locked to exactly that origin. ALLOW_DOMAIN takes FULL origins with
+# scheme (verified in the 1.27 config cheat sheet; a SCHEME key no longer
+# exists). Authorization must be listed in HEADERS — the default set
+# (Content-Type,User-Agent) would block Sveltia's authenticated API calls.
+Environment=GITEA__cors__ENABLED=true
+Environment=GITEA__cors__ALLOW_DOMAIN=https://astro.isl-dev.grid.cyfronet.pl
+Environment=GITEA__cors__HEADERS=Authorization,Content-Type,User-Agent
+Environment=GITEA__cors__METHODS=GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS
+
+[Service]
+Restart=on-failure
+# Shared 3.6 GB VM (Outline + Strapi live here too) — keep Gitea on a leash.
+MemoryHigh=400M
+MemoryMax=600M
+
+[Install]
+WantedBy=default.target