From 746b015e854e57d4ec2c0e7bb782316dab6bc8ec Mon Sep 17 00:00:00 2001
From: Mieszko Makuch <m.makuch@cyfronet.pl>
Date: Wed, 29 Jul 2026 10:35:26 +0200
Subject: [PATCH] vhost switch: Sveltia backend + Gitea ROOT_URL to https
 ingress domains, CORS locked to the portal origin

---
 deploy/ctao-demo-gitea.container | 13 ++++++-------
 public/admin/config.yml          | 14 ++++++--------
 2 files changed, 12 insertions(+), 15 deletions(-)

diff --git a/deploy/ctao-demo-gitea.container b/deploy/ctao-demo-gitea.container
index 8a6ec92..03e476c 100644
--- a/deploy/ctao-demo-gitea.container
+++ b/deploy/ctao-demo-gitea.container
@@ -28,9 +28,8 @@ PublishPort=3000:3000
 # (see .skills/gitea/SKILL.md). Secrets: none here; the admin account is
 # created interactively after first start (README).
 Environment=GITEA__server__HTTP_PORT=3000
-# TODO(vhost): set to the public URL once the ingress vhost exists,
-# e.g. https://gitea-portal-demo.isl-dev.grid.cyfronet.pl/ — then restart.
-Environment=GITEA__server__ROOT_URL=http://localhost:3000/
+# Public URL via the Cyfronet ingress (vhost by Hubert, 2026-07-29).
+Environment=GITEA__server__ROOT_URL=https://astro-git.isl-dev.grid.cyfronet.pl/
 Environment=GITEA__server__DISABLE_SSH=true
 Environment=GITEA__database__DB_TYPE=sqlite3
 Environment=GITEA__security__INSTALL_LOCK=true
@@ -42,11 +41,11 @@ Environment=GITEA__repository__ENABLE_PUSH_CREATE_USER=true
 Environment=GITEA__repository__DEFAULT_PRIVATE=public
 # Push-created repos have their OWN default (true = private) — learned the hard way:
 Environment=GITEA__repository__DEFAULT_PUSH_CREATE_PRIVATE=false
-# Sveltia is served from the portal vhost and calls the Gitea API cross-origin.
-# TODO(vhost): tighten * to the portal origin once known, and add
-# GITEA__cors__SCHEME=https (the [cors] SCHEME default is http).
+# Sveltia is served from the portal vhost and calls the Gitea API cross-origin
+# — CORS locked to exactly that origin.
 Environment=GITEA__cors__ENABLED=true
-Environment=GITEA__cors__ALLOW_DOMAIN=*
+Environment=GITEA__cors__SCHEME=https
+Environment=GITEA__cors__ALLOW_DOMAIN=astro.isl-dev.grid.cyfronet.pl
 Environment=GITEA__cors__METHODS=GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS
 
 [Service]
diff --git a/public/admin/config.yml b/public/admin/config.yml
index c206900..fe2a887 100644
--- a/public/admin/config.yml
+++ b/public/admin/config.yml
@@ -1,15 +1,13 @@
-# Sveltia CMS config — backend: Gitea on the Cyfronet machine (demo). Editors
-# log in via Gitea OAuth (PKCE, no client secret); edits are committed to the
-# ctao/portal repo. localhost:3000 works both on the machine and through the
-# ssh -L tunnel (same port number keeps Gitea's ROOT_URL valid).
-# TODO(vhost): switch base_url/api_root to the public Gitea URL once the
-# ingress vhost exists (and update the OAuth app's redirect_uris + ROOT_URL).
+# Sveltia CMS config — backend: Gitea behind the Cyfronet ingress (HTTPS
+# vhost). Editors log in via Gitea OAuth (PKCE, no client secret); edits are
+# committed to the ctao/portal repo. Gitea's ROOT_URL and CORS are pinned to
+# these origins in deploy/ctao-demo-gitea.container.
 backend:
   name: gitea
   repo: ctao/portal
   branch: main
-  base_url: http://localhost:3000
-  api_root: http://localhost:3000/api/v1
+  base_url: https://astro-git.isl-dev.grid.cyfronet.pl
+  api_root: https://astro-git.isl-dev.grid.cyfronet.pl/api/v1
   app_id: cf1c44ac-ebe6-4a97-bf2f-f7f26ef1126c
   # OAuth only — hides the "access token" sign-in option (documented
   # auth_methods). The "Work with Local Repository" button needs no config: