gitea actions

README.md

@@ -20,6 +20,7 @@ The **private key is generated on the server**, packed into a PKCS#12, and sent
 | --- | --- |
 | [docs/architecture.md](docs/architecture.md) | Request flow, the two PKCS#12s, why phones never talk to the CA |
 | [docs/setup.md](docs/setup.md) | OIDC, LDAP, certsrv, TLS, Docker / `python -m cert_portal` |
+| [docs/gitea.md](docs/gitea.md) | Gitea Actions: build and publish to the container registry |
 | [docs/adcs.md](docs/adcs.md) | Web Enrollment, template flags, SID URI / strong mapping |
 | [docs/profile-signing.md](docs/profile-signing.md) | Signing identity, device trust, CMS format |
 | [docs/security.md](docs/security.md) | Key lifetime, logging, sessions, who can download |
@@ -31,7 +32,7 @@ After sign-in, operators and users can also open **Help** in the app (`/help`) w
 
 1. Copy `.env.example` to `.env` and fill in OIDC, LDAP, certsrv, and the profile-signing PKCS#12 path.
 2. Python 3.12+: `pip install -e ".[dev]"` then `python -m cert_portal`
-3. Or: `docker build -t cert-portal .` and run with `--env-file .env`, publishing port 8000, mounting the signing P12.
+3. Or pull `git.atlashorizon.net/nick/cert-portal:latest` from the Gitea registry (see [docs/gitea.md](docs/gitea.md)), or `docker build -t cert-portal .` locally. Run with `--env-file .env`, publishing port 8000, mounting the signing P12.
 
 Put a reverse proxy in front for TLS. Set `PUBLIC_BASE_URL` and `OIDC_REDIRECT_URI` to that HTTPS origin (`/auth/callback`).