# CTAO portal demo — static web server. Serves ~/ctao-portal-demo/releases/current
# (a symlink the build flips atomically). Read-only mounts: nginx can only read.
# Quadlet unit → service name: ctao-demo-web.service.

[Unit]
Description=CTAO portal demo — static web server (nginx)
Wants=network-online.target
After=network-online.target

[Container]
ContainerName=ctao-demo-web
# Official image; re-pin to the exact digest at install (same drill as Gitea).
Image=docker.io/library/nginx:stable-alpine
# releases/ is shared with the build container (:z shared label);
# the config file is exclusive to nginx (:Z).
Volume=%h/ctao-portal-demo/releases:/srv/releases:ro,z
Volume=%h/ctao-portal-demo/config/nginx.conf:/etc/nginx/conf.d/default.conf:ro,Z
PublishPort=8080:80

[Service]
Restart=on-failure
MemoryHigh=64M

[Install]
WantedBy=default.target