deploy: machine deployment — quadlets (gitea, nginx, isolated build network), poll+build pipeline, runbook

Reviewed (Opus security review, all findings verified) and tested end-to-end
locally: cold build 23s, no-op poll 45ms, incremental rebuild 4s, prune,
gitea-down grace, real bridge network with container DNS.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012jWfn3RwPfFGTtBddm36Uy
This commit is contained in:
2026-07-28 13:44:46 +02:00
co-authored by Claude Fable 5
parent 4102974927
commit ed7a9c01e7
9 changed files with 336 additions and 0 deletions
+7
View File
@@ -0,0 +1,7 @@
# Build image for the CTAO portal demo: pinned Node + git.
# Why: the host has node 24 but NO git (and we have no sudo); a 2-line image
# keeps the whole toolchain pinned and independent of host packages.
# Built ONCE at install, never pulled again at runtime:
# podman build -t localhost/ctao-portal-build:1 -f Containerfile.build .
FROM docker.io/library/node:24-alpine
RUN apk add --no-cache git