vhost switch: Sveltia backend + Gitea ROOT_URL to https ingress domains, CORS locked to the portal origin

deploy/ctao-demo-gitea.container

@@ -28,9 +28,8 @@ PublishPort=3000:3000
 # (see .skills/gitea/SKILL.md). Secrets: none here; the admin account is
 # created interactively after first start (README).
 Environment=GITEA__server__HTTP_PORT=3000
-# TODO(vhost): set to the public URL once the ingress vhost exists,
-# e.g. https://gitea-portal-demo.isl-dev.grid.cyfronet.pl/ — then restart.
-Environment=GITEA__server__ROOT_URL=http://localhost:3000/
+# Public URL via the Cyfronet ingress (vhost by Hubert, 2026-07-29).
+Environment=GITEA__server__ROOT_URL=https://astro-git.isl-dev.grid.cyfronet.pl/
 Environment=GITEA__server__DISABLE_SSH=true
 Environment=GITEA__database__DB_TYPE=sqlite3
 Environment=GITEA__security__INSTALL_LOCK=true
@@ -42,11 +41,11 @@ Environment=GITEA__repository__ENABLE_PUSH_CREATE_USER=true
 Environment=GITEA__repository__DEFAULT_PRIVATE=public
 # Push-created repos have their OWN default (true = private) — learned the hard way:
 Environment=GITEA__repository__DEFAULT_PUSH_CREATE_PRIVATE=false
-# Sveltia is served from the portal vhost and calls the Gitea API cross-origin.
-# TODO(vhost): tighten * to the portal origin once known, and add
-# GITEA__cors__SCHEME=https (the [cors] SCHEME default is http).
+# Sveltia is served from the portal vhost and calls the Gitea API cross-origin
+# — CORS locked to exactly that origin.
 Environment=GITEA__cors__ENABLED=true
-Environment=GITEA__cors__ALLOW_DOMAIN=*
+Environment=GITEA__cors__SCHEME=https
+Environment=GITEA__cors__ALLOW_DOMAIN=astro.isl-dev.grid.cyfronet.pl
 Environment=GITEA__cors__METHODS=GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS
 
 [Service]