Tomter Vel's own platform: Caddy, NATS, Kanidm and portal as containers

One host, four containers, content fetched from tomtervel/questions.
bootstrap.sh renders configs from .env and recovers the Kanidm admin;
kanidm-setup.sh creates the portal client and the desk groups. An
optional runner profile lets the content repo's reload reach this host.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -0,0 +1,32 @@
+# Deploy from this repo: on the vel's own host, a runner registered
+# against prosjekt.klingenbergbygg.no with the label `tomtervel`
+# (the `runner` profile in compose.yml) checks out this repo and
+# brings the stack up. Rolling out a new portal version is a commit
+# that bumps PORTAL_RELEASE in .env.example and, on the host, in .env.
+#
+# Until that runner exists, this workflow queues and does nothing;
+# deploy by hand with `git pull && docker compose up -d --build` on
+# the host.
+name: deploy
+on:
+  push:
+    branches: [main]
+    paths:
+      - compose.yml
+      - Caddyfile
+      - portal/**
+      - kanidm/server.toml.tpl
+      - nats/nats.conf.tpl
+      - .gitea/workflows/deploy.yml
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    runs-on: tomtervel
+    steps:
+      - name: Pull and restart
+        run: |
+          set -eu
+          cd /srv/tomtervel/infrastructure
+          git pull --ff-only
+          sh bootstrap.sh