CTAO Science Portal: static Astro site with git-based CMS (Sveltia + Gitea)

Portal code only; editorial content lives in the ctao/content repo on the
demo machine's Gitea and is overlaid at build time (see README.md and
deploy/README.md). Live demo: https://astro.isl-dev.grid.cyfronet.pl

deploy/ctao-demo-web.container

@@ -0,0 +1,28 @@
+# CTAO portal demo — static web server. Serves ~/ctao-portal-demo/releases/current
+# (a symlink the build flips atomically). Read-only mounts: nginx can only read.
+# Quadlet unit → service name: ctao-demo-web.service.
+
+[Unit]
+Description=CTAO portal demo — static web server (nginx)
+Wants=network-online.target
+After=network-online.target
+
+[Container]
+ContainerName=ctao-demo-web
+# Pinned by digest at install (2026-07-28); tag kept for readability.
+Image=docker.io/library/nginx:stable-alpine@sha256:97d490c12ba55b4946b01546d1c3ed324e8d41ab1c9fcb2a616aa470620e5b46
+# releases/ is shared with the build container (:z shared label);
+# the config file is exclusive to nginx (:Z).
+Volume=%h/ctao-portal-demo/releases:/srv/releases:ro,z
+Volume=%h/ctao-portal-demo/config/nginx.conf:/etc/nginx/conf.d/default.conf:ro,Z
+# All-interfaces bind is deliberate — the ingress box reaches us over the
+# network (see the matching note in ctao-demo-gitea.container).
+PublishPort=8080:80
+
+[Service]
+Restart=on-failure
+MemoryHigh=64M
+MemoryMax=128M
+
+[Install]
+WantedBy=default.target