# CTAO portal demo — static web server. Serves ~/ctao-portal-demo/releases/current
# (a symlink the build flips atomically). Read-only mounts: nginx can only read.
# Quadlet unit → service name: ctao-demo-web.service.

[Unit]
Description=CTAO portal demo — static web server (nginx)
Wants=network-online.target
After=network-online.target

[Container]
ContainerName=ctao-demo-web
# Pinned by digest at install (2026-07-28); tag kept for readability.
Image=docker.io/library/nginx:stable-alpine@sha256:97d490c12ba55b4946b01546d1c3ed324e8d41ab1c9fcb2a616aa470620e5b46
# releases/ is shared with the build container (:z shared label);
# the config file is exclusive to nginx (:Z).
Volume=%h/ctao-portal-demo/releases:/srv/releases:ro,z
Volume=%h/ctao-portal-demo/config/nginx.conf:/etc/nginx/conf.d/default.conf:ro,Z
PublishPort=8080:80

[Service]
Restart=on-failure
MemoryHigh=64M

[Install]
WantedBy=default.target