ctao/portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

handoff pass: vendored sveltia bundle, astro pinned ^7.2.10, root README + refreshed deploy runbook, review fixes (coverless card grid, shared NewsCard/lib, real site origin, nginx security headers, linger step, dead config removed, preview.css sync, tsconfig)

Browse Source
This commit is contained in:
ctao
2026-09-03 14:56:53 +02:00
parent c64528a1d3
commit cec8018c18
35 changed files with 4095 additions and 2111 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/ctao-demo-gitea.container
+7 -6
View File
@@ -22,25 +22,26 @@ UserNS=keep-id:uid=1000,gid=1000
# so it sees Gitea on localhost:3000 while the HOST loopback stays invisible.
Volume=%h/ctao-portal-demo/gitea-data:/var/lib/gitea:Z
Volume=%h/ctao-portal-demo/gitea-config:/etc/gitea:Z
# Bound on all interfaces DELIBERATELY: the ingress that terminates the
# public vhost runs on a separate box and reaches this VM over the network —
# a 127.0.0.1 bind would cut it off.
PublishPort=3000:3000
# Env-driven config — re-applied on every start, no hand-edited app.ini
# (see .skills/gitea/SKILL.md). Secrets: none here; the admin account is
# created interactively after first start (README).
Environment=GITEA__server__HTTP_PORT=3000
# Public URL via the Cyfronet ingress (vhost by Hubert, 2026-07-29).
# Public URL via the Cyfronet ingress vhost.
Environment=GITEA__server__ROOT_URL=https://astro-git.isl-dev.grid.cyfronet.pl/
Environment=GITEA__server__DISABLE_SSH=true
Environment=GITEA__database__DB_TYPE=sqlite3
Environment=GITEA__security__INSTALL_LOCK=true
Environment=GITEA__service__DISABLE_REGISTRATION=true
Environment=GITEA__mailer__ENABLED=false
# First `git push` auto-creates the repo (no UI step); public so the build
# pipeline can clone anonymously — content is the public site anyway.
Environment=GITEA__repository__ENABLE_PUSH_CREATE_USER=true
# Repos default to public so the build pipeline can clone anonymously —
# content is the public site anyway. The `ctao/portal` repo itself is
# created in the UI (README step 6).
Environment=GITEA__repository__DEFAULT_PRIVATE=public
# Push-created repos have their OWN default (true = private) — learned the hard way:
Environment=GITEA__repository__DEFAULT_PUSH_CREATE_PRIVATE=false
# Sveltia is served from the portal vhost and calls the Gitea API cross-origin
# — CORS locked to exactly that origin. ALLOW_DOMAIN takes FULL origins with
# scheme (verified in the 1.27 config cheat sheet; a SCHEME key no longer