# CTAO portal demo — Gitea (CMS backend: content repo, editor accounts, OAuth for Sveltia)
# Quadlet unit. Install: copy to ~/.config/containers/systemd/ on the machine,
# then `systemctl --user daemon-reload` → service name: ctao-demo-gitea.service.
# Rootless image + SQLite by design: one container, no DB server, all state
# lives in ~/ctao-portal-demo/gitea-{data,config} — nothing else on the machine.

[Unit]
Description=CTAO portal demo — Gitea
Wants=network-online.target
After=network-online.target

[Container]
ContainerName=ctao-demo-gitea
# Pinned by digest at install (2026-07-28); tag kept for readability.
Image=docker.io/gitea/gitea:1.27-rootless@sha256:36cce26be71609091e1236d5b5de2c66a81fb8a7d45756a5fd3b7a28c11733b7
# The rootless image runs as uid 1000 inside; keep-id maps it to the host user
# so the bind-mounted dirs stay owned by `strapi` (no chown, no root anywhere).
UserNS=keep-id:uid=1000,gid=1000
# Networking: default rootless pasta (userspace — the machine's kernel lacks
# ip_tables for rootless netavark bridges, and we have no sudo). The build
# container joins THIS container's netns (--network=container:ctao-demo-gitea),
# so it sees Gitea on localhost:3000 while the HOST loopback stays invisible.
Volume=%h/ctao-portal-demo/gitea-data:/var/lib/gitea:Z
Volume=%h/ctao-portal-demo/gitea-config:/etc/gitea:Z
PublishPort=3000:3000

# Env-driven config — re-applied on every start, no hand-edited app.ini
# (see .skills/gitea/SKILL.md). Secrets: none here; the admin account is
# created interactively after first start (README).
Environment=GITEA__server__HTTP_PORT=3000
# TODO(vhost): set to the public URL once the ingress vhost exists,
# e.g. https://gitea-portal-demo.isl-dev.grid.cyfronet.pl/ — then restart.
Environment=GITEA__server__ROOT_URL=http://localhost:3000/
Environment=GITEA__server__DISABLE_SSH=true
Environment=GITEA__database__DB_TYPE=sqlite3
Environment=GITEA__security__INSTALL_LOCK=true
Environment=GITEA__service__DISABLE_REGISTRATION=true
Environment=GITEA__mailer__ENABLED=false
# First `git push` auto-creates the repo (no UI step); public so the build
# pipeline can clone anonymously — content is the public site anyway.
Environment=GITEA__repository__ENABLE_PUSH_CREATE_USER=true
Environment=GITEA__repository__DEFAULT_PRIVATE=public
# Push-created repos have their OWN default (true = private) — learned the hard way:
Environment=GITEA__repository__DEFAULT_PUSH_CREATE_PRIVATE=false
# Sveltia is served from the portal vhost and calls the Gitea API cross-origin.
# TODO(vhost): tighten * to the portal origin once known, and add
# GITEA__cors__SCHEME=https (the [cors] SCHEME default is http).
Environment=GITEA__cors__ENABLED=true
Environment=GITEA__cors__ALLOW_DOMAIN=*
Environment=GITEA__cors__METHODS=GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS

[Service]
Restart=on-failure
# Shared 3.6 GB VM (Outline + Strapi live here too) — keep Gitea on a leash.
MemoryHigh=400M
MemoryMax=600M

[Install]
WantedBy=default.target