deploy: machine deployment — quadlets (gitea, nginx, isolated build network), poll+build pipeline, runbook

Reviewed (Opus security review, all findings verified) and tested end-to-end
locally: cold build 23s, no-op poll 45ms, incremental rebuild 4s, prune,
gitea-down grace, real bridge network with container DNS.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012jWfn3RwPfFGTtBddm36Uy

deploy/ctao-demo-gitea.container

@@ -0,0 +1,54 @@
+# CTAO portal demo — Gitea (CMS backend: content repo, editor accounts, OAuth for Sveltia)
+# Quadlet unit. Install: copy to ~/.config/containers/systemd/ on the machine,
+# then `systemctl --user daemon-reload` → service name: ctao-demo-gitea.service.
+# Rootless image + SQLite by design: one container, no DB server, all state
+# lives in ~/ctao-portal-demo/gitea-{data,config} — nothing else on the machine.
+
+[Unit]
+Description=CTAO portal demo — Gitea
+Wants=network-online.target
+After=network-online.target
+
+[Container]
+ContainerName=ctao-demo-gitea
+# Same major as the local demo (1.27). Re-pin to the exact digest at install:
+#   podman pull docker.io/gitea/gitea:1.27-rootless
+#   podman images --digests docker.io/gitea/gitea   → paste sha256 here
+Image=docker.io/gitea/gitea:1.27-rootless
+# The rootless image runs as uid 1000 inside; keep-id maps it to the host user
+# so the bind-mounted dirs stay owned by `strapi` (no chown, no root anywhere).
+UserNS=keep-id:uid=1000,gid=1000
+# Shared bridge with the build containers (name-resolvable as ctao-demo-gitea);
+# host loopback stays out of reach for build code — see ctao-demo.network.
+Network=ctao-demo.network
+Volume=%h/ctao-portal-demo/gitea-data:/var/lib/gitea:Z
+Volume=%h/ctao-portal-demo/gitea-config:/etc/gitea:Z
+PublishPort=3000:3000
+
+# Env-driven config — re-applied on every start, no hand-edited app.ini
+# (see .skills/gitea/SKILL.md). Secrets: none here; the admin account is
+# created interactively after first start (README).
+Environment=GITEA__server__HTTP_PORT=3000
+# TODO(vhost): set to the public URL once the ingress vhost exists,
+# e.g. https://gitea-portal-demo.isl-dev.grid.cyfronet.pl/ — then restart.
+Environment=GITEA__server__ROOT_URL=http://localhost:3000/
+Environment=GITEA__server__DISABLE_SSH=true
+Environment=GITEA__database__DB_TYPE=sqlite3
+Environment=GITEA__security__INSTALL_LOCK=true
+Environment=GITEA__service__DISABLE_REGISTRATION=true
+Environment=GITEA__mailer__ENABLED=false
+# Sveltia is served from the portal vhost and calls the Gitea API cross-origin.
+# TODO(vhost): tighten * to the portal origin once known, and add
+# GITEA__cors__SCHEME=https (the [cors] SCHEME default is http).
+Environment=GITEA__cors__ENABLED=true
+Environment=GITEA__cors__ALLOW_DOMAIN=*
+Environment=GITEA__cors__METHODS=GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS
+
+[Service]
+Restart=on-failure
+# Shared 3.6 GB VM (Outline + Strapi live here too) — keep Gitea on a leash.
+MemoryHigh=400M
+MemoryMax=600M
+
+[Install]
+WantedBy=default.target