From 9ae0dfa4296d2cc010fca6da14438c20b88ed0a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hern=C3=A2ni=20Marques?= <hernani+magikoopa@vecirex.net>
Date: Mon, 24 Aug 2026 08:47:22 +0200
Subject: [PATCH] decidim: mirror koopa-decidim setup (9027, docs for /sm
 showcase)

---
 configs/README.md                             |   2 +-
 configs/caddy/decidim.hacktivism.ch.caddy     |  17 ++
 configs/decidim/.env.example                  |  13 +
 configs/decidim/README.md                     |  23 ++
 configs/decidim/assets/img/favicon.svg        |  90 +++++++
 configs/decidim/assets/img/isoc-gold.png      | Bin 0 -> 8156 bytes
 configs/decidim/assets/img/logo.svg           |  90 +++++++
 configs/decidim/bin/apply-branding.sh         |  22 ++
 configs/decidim/bin/install-systemd.sh        |  38 +++
 configs/decidim/bin/seed-example.sh           |  39 +++
 configs/decidim/bin/up.sh                     |  21 ++
 configs/decidim/bootstrap.rb                  |  78 ++++++
 configs/decidim/compose.yml                   | 131 ++++++++++
 .../container-koopa-decidim-db.service        |  21 ++
 .../decidim/container-koopa-decidim.service   |  21 ++
 configs/decidim/entrypoint.sh                 |  22 ++
 configs/decidim/seed_example.rb               | 247 ++++++++++++++++++
 configs/decidim/theme/hacktivism-consent.js   |  10 +
 configs/decidim/theme/hacktivism.css          |  98 +++++++
 configs/decidim/theme/hacktivism.rb           |  14 +
 configs/ports.md                              |   3 +-
 21 files changed, 998 insertions(+), 2 deletions(-)
 create mode 100644 configs/caddy/decidim.hacktivism.ch.caddy
 create mode 100644 configs/decidim/.env.example
 create mode 100644 configs/decidim/README.md
 create mode 100644 configs/decidim/assets/img/favicon.svg
 create mode 100644 configs/decidim/assets/img/isoc-gold.png
 create mode 100644 configs/decidim/assets/img/logo.svg
 create mode 100755 configs/decidim/bin/apply-branding.sh
 create mode 100755 configs/decidim/bin/install-systemd.sh
 create mode 100755 configs/decidim/bin/seed-example.sh
 create mode 100755 configs/decidim/bin/up.sh
 create mode 100644 configs/decidim/bootstrap.rb
 create mode 100644 configs/decidim/compose.yml
 create mode 100644 configs/decidim/container-koopa-decidim-db.service
 create mode 100644 configs/decidim/container-koopa-decidim.service
 create mode 100755 configs/decidim/entrypoint.sh
 create mode 100644 configs/decidim/seed_example.rb
 create mode 100644 configs/decidim/theme/hacktivism-consent.js
 create mode 100644 configs/decidim/theme/hacktivism.css
 create mode 100644 configs/decidim/theme/hacktivism.rb

diff --git a/configs/README.md b/configs/README.md
index a0904e0..61e422b 100644
--- a/configs/README.md
+++ b/configs/README.md
@@ -9,7 +9,7 @@ Directories are named to match **live podman container names** where possible.
 | `taler-exchange/` | conf inside exchange container | (see exchange-ansible) |
 | `taler-exchange-ansible/` | **`taler-hacktivism-exchange-ansible`** | `taler-hacktivism-exchange-ansible:landing` |
 | `bank-landing/` `exchange-landing/` `merchant-landing/` | nginx landing snippets | ports 9013–9015 |
-| `koopa-*` apps | `koopa-castopod`, `koopa-bonfire`, `koopa-lemmy`, … | compose mirrors |
+| `koopa-*` apps | `koopa-castopod`, `koopa-bonfire`, `koopa-lemmy`, `koopa-decidim`, … | compose mirrors |
 | `tops/` | `koopa-tops-ng1` … `ng3` | `nginxinc/nginx-unprivileged:1.27-alpine` (non-root, :8080) |
 | `caddy/` `firewalld/` `systemd/` | host services | |
 | `tor/` | **`koopa-tor-relay`** (podman host net) | `localhost/koopa-tor-relay:latest` (**non-root** uid 1000) |
diff --git a/configs/caddy/decidim.hacktivism.ch.caddy b/configs/caddy/decidim.hacktivism.ch.caddy
new file mode 100644
index 0000000..0d3970f
--- /dev/null
+++ b/configs/caddy/decidim.hacktivism.ch.caddy
@@ -0,0 +1,17 @@
+# 9027 decidim (rails)
+# Live: merged into /etc/caddy/Caddyfile
+decidim.hacktivism.ch {
+	header Alt-Svc "clear"
+	reverse_proxy 127.0.0.1:9027 {
+		header_up Host {host}
+		header_up X-Forwarded-For {remote_host}
+		header_up X-Forwarded-Host {host}
+		header_up X-Forwarded-Proto {scheme}
+		header_up X-Forwarded-Port 443
+		flush_interval -1
+		transport http {
+			read_timeout 3600s
+			write_timeout 3600s
+		}
+	}
+}
diff --git a/configs/decidim/.env.example b/configs/decidim/.env.example
new file mode 100644
index 0000000..303db55
--- /dev/null
+++ b/configs/decidim/.env.example
@@ -0,0 +1,13 @@
+POSTGRES_PASSWORD=@inline-secret@
+SECRET_KEY_BASE=@inline-secret@
+DECIDIM_APPLICATION_NAME=hacktivism
+DECIDIM_MAILER_SENDER=noreply@hacktivism.ch
+DECIDIM_AVAILABLE_LOCALES=en,de,fr
+DECIDIM_DEFAULT_LOCALE=en
+DECIDIM_HOST=decidim.hacktivism.ch
+SMTP_ADDRESS=127.0.0.1
+SMTP_DOMAIN=hacktivism.ch
+SMTP_USERNAME=unused
+SMTP_PASSWORD=unused
+SMTP_PORT=25
+QUEUE_ADAPTER=sidekiq
diff --git a/configs/decidim/README.md b/configs/decidim/README.md
new file mode 100644
index 0000000..ea04610
--- /dev/null
+++ b/configs/decidim/README.md
@@ -0,0 +1,23 @@
+# Decidim — decidim.hacktivism.ch
+
+| Item | Value |
+|------|--------|
+| Live | `/home/hernani/koopa-decidim/` |
+| Compose | `compose.yml` (mirror, no secrets) |
+| Port | **9027** → Caddy |
+| Site | https://decidim.hacktivism.ch/ |
+| Image | `decidim/decidim:0.30.8` + postgres 16 + redis 7 + sidekiq |
+
+Secrets: host `~/koopa-decidim/{.env,users.env}` (mode 600). Not in this repo.
+
+Theme: `theme/hacktivism.css` + `theme/hacktivism.rb` (same exchange-dark palette as Bonfire/Castopod). Analog stack: `configs/castopod/`.
+
+```bash
+cd ~/koopa-decidim && set -a && source .env && set +a && podman-compose up -d
+~/koopa-decidim/bin/install-systemd.sh
+~/koopa-decidim/bin/apply-branding.sh
+```
+
+Caddy: `sudo /home/hernani/koopa-caddy/apply.sh` (vhost `decidim.hacktivism.ch` → `127.0.0.1:9027`).
+
+This tree documents **this** instance only. Secrets stay in `koopa-admin-secrets` / host `~/koopa-decidim/{.env,users.env}`.
diff --git a/configs/decidim/assets/img/favicon.svg b/configs/decidim/assets/img/favicon.svg
new file mode 100644
index 0000000..e1d3dc3
--- /dev/null
+++ b/configs/decidim/assets/img/favicon.svg
@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" width="128" height="128" role="img" aria-label="Wizard flying on magic wand, blue robe">
+  <!-- Original Kamek-inspired mark; not Nintendo art. No filters/transforms for clean raster. -->
+
+  <!-- motion streaks -->
+  <line x1="4" y1="64" x2="22" y2="64" stroke="#5eead4" stroke-width="2.5" stroke-linecap="round" opacity="0.55"/>
+  <line x1="6" y1="74" x2="20" y2="74" stroke="#38bdf8" stroke-width="2" stroke-linecap="round" opacity="0.45"/>
+  <line x1="8" y1="54" x2="20" y2="54" stroke="#fde68a" stroke-width="2" stroke-linecap="round" opacity="0.45"/>
+
+  <!-- ground shadow -->
+  <ellipse cx="64" cy="118" rx="30" ry="5" fill="#000" opacity="0.2"/>
+
+  <!-- ===== MAGIC WAND (mount) — diagonal, thick gold shaft ===== -->
+  <!-- sits under the rider from lower-left to upper-right -->
+  <line x1="6" y1="100" x2="108" y2="72" stroke="#92400e" stroke-width="11" stroke-linecap="round"/>
+  <line x1="6" y1="100" x2="108" y2="72" stroke="#e8a838" stroke-width="7" stroke-linecap="round"/>
+  <line x1="6" y1="100" x2="108" y2="72" stroke="#fde68a" stroke-width="2" stroke-linecap="round" opacity="0.75"/>
+
+  <!-- wand jewel (front tip) -->
+  <circle cx="112" cy="70" r="13" fill="#f59e0b" stroke="#fff7ed" stroke-width="3"/>
+  <circle cx="108" cy="66" r="4.5" fill="#fef9c3"/>
+  <!-- sparkles at tip -->
+  <polygon points="120,54 121.6,58.5 126,60 121.6,61.5 120,66 118.4,61.5 114,60 118.4,58.5" fill="#fef08a"/>
+  <polygon points="102,56 103,59 106,60 103,61 102,64 101,61 98,60 101,59" fill="#5eead4"/>
+  <circle cx="118" cy="78" r="2" fill="#bae6fd"/>
+
+  <!-- ===== RIDER on top of wand ===== -->
+  <!-- blue cape fluttering left -->
+  <path d="M38 78 C18 82, 10 98, 8 110 C22 98, 34 96, 40 92 Z" fill="#1e3a8a"/>
+  <path d="M40 80 C22 88, 14 104, 12 112 C28 100, 36 98, 42 94 Z" fill="#1d4ed8"/>
+
+  <!-- BLUE ROBE (body sitting ON shaft) -->
+  <ellipse cx="54" cy="86" rx="28" ry="22" fill="#1d4ed8"/>
+  <ellipse cx="54" cy="84" rx="24" ry="18" fill="#2563eb"/>
+  <!-- white trim -->
+  <path d="M32 74 Q54 94 76 74" fill="none" stroke="#f8fafc" stroke-width="4" stroke-linecap="round"/>
+  <path d="M36 82 Q54 98 72 82" fill="none" stroke="#e2e8f0" stroke-width="2.5" stroke-linecap="round"/>
+
+  <!-- green shell -->
+  <ellipse cx="66" cy="92" rx="13" ry="11" fill="#16a34a"/>
+  <ellipse cx="66" cy="92" rx="6" ry="5" fill="#86efac" opacity="0.75"/>
+
+  <!-- legs over the wand -->
+  <ellipse cx="42" cy="100" rx="10" ry="7" fill="#1e40af"/>
+  <ellipse cx="60" cy="102" rx="10" ry="7" fill="#1e40af"/>
+  <!-- yellow feet hanging past shaft -->
+  <ellipse cx="38" cy="106" rx="7" ry="4.5" fill="#fbbf24"/>
+  <ellipse cx="64" cy="108" rx="7" ry="4.5" fill="#fbbf24"/>
+
+  <!-- left arm forward -->
+  <ellipse cx="30" cy="82" rx="9" ry="7" fill="#1d4ed8"/>
+  <circle cx="24" cy="78" r="5.5" fill="#fbbf24"/>
+  <!-- right arm up -->
+  <ellipse cx="74" cy="74" rx="9" ry="7" fill="#1d4ed8"/>
+  <circle cx="80" cy="68" r="5.5" fill="#fbbf24"/>
+  <circle cx="82" cy="60" r="5" fill="#38bdf8"/>
+  <circle cx="81" cy="58" r="1.8" fill="#e0f2fe"/>
+
+  <!-- ===== HEAD ===== -->
+  <ellipse cx="54" cy="50" rx="26" ry="24" fill="#fbbf24"/>
+  <ellipse cx="54" cy="53" rx="21" ry="17" fill="#fcd34d"/>
+  <ellipse cx="34" cy="54" rx="6" ry="4" fill="#fb923c" opacity="0.4"/>
+  <ellipse cx="74" cy="54" rx="6" ry="4" fill="#fb923c" opacity="0.4"/>
+
+  <!-- glasses -->
+  <circle cx="42" cy="50" r="10" fill="#bae6fd" fill-opacity="0.4" stroke="#0f172a" stroke-width="3"/>
+  <circle cx="66" cy="50" r="10" fill="#bae6fd" fill-opacity="0.4" stroke="#0f172a" stroke-width="3"/>
+  <line x1="52" y1="50" x2="56" y2="50" stroke="#0f172a" stroke-width="3"/>
+  <line x1="32" y1="47" x2="24" y2="42" stroke="#0f172a" stroke-width="2.5" stroke-linecap="round"/>
+  <line x1="76" y1="47" x2="84" y2="42" stroke="#0f172a" stroke-width="2.5" stroke-linecap="round"/>
+  <circle cx="44" cy="50" r="3" fill="#0f172a"/>
+  <circle cx="68" cy="50" r="3" fill="#0f172a"/>
+  <circle cx="45.2" cy="48.8" r="1.1" fill="#fff"/>
+  <circle cx="69.2" cy="48.8" r="1.1" fill="#fff"/>
+
+  <!-- snout + mustache -->
+  <ellipse cx="54" cy="62" rx="8" ry="5" fill="#f59e0b"/>
+  <path d="M36 64 Q46 74 54 70 Q62 74 72 64 Q64 72 54 74 Q44 72 36 64 Z" fill="#f8fafc"/>
+  <path d="M44 66 Q54 74 64 66" fill="none" stroke="#92400e" stroke-width="2.2" stroke-linecap="round"/>
+
+  <!-- BLUE pointed hat -->
+  <path d="M28 44 L54 2 L80 44 Z" fill="#1d4ed8"/>
+  <path d="M36 44 L54 10 L72 44 Z" fill="#3b82f6" opacity="0.5"/>
+  <ellipse cx="54" cy="44" rx="30" ry="8" fill="#1e40af"/>
+  <ellipse cx="54" cy="42.5" rx="26" ry="5" fill="#2563eb"/>
+  <ellipse cx="54" cy="44" rx="30" ry="8" fill="none" stroke="#f8fafc" stroke-width="2.2"/>
+  <polygon points="54,12 55.6,16.8 60.5,18.4 55.6,20 54,24.8 52.4,20 47.5,18.4 52.4,16.8" fill="#f8fafc"/>
+  <polygon points="42,22 43.1,25.2 46.2,26.4 43.1,27.6 42,30.8 40.9,27.6 37.8,26.4 40.9,25.2" fill="#fef08a"/>
+  <circle cx="54" cy="4" r="6" fill="#f8fafc"/>
+</svg>
diff --git a/configs/decidim/assets/img/isoc-gold.png b/configs/decidim/assets/img/isoc-gold.png
new file mode 100644
index 0000000000000000000000000000000000000000..21ec52b671cda2db0d67fcd86e744915efd2c904
GIT binary patch
literal 8156
zcmV<2A0yz2P)<h;3K|Lk000e1NJLTq0052v0052%1^@s6=lw7U00009a7bBm000XU
z000XU0RWnu7ytktj!8s8RCt{2oeBJ8MRCVxky8!<6%EQE$PpqSDvA<zIV90=B*qg_
zP?5tk1~max4nx$as2CL`2q+pAR8(@PkpK#)KtLr%5nPZUln3|CF1z-Z?&8(-biemz
z{_mLGo&J34GxPrcdHw2j|GK)mx~h6GSV4<?ai>Q(;`8qv-Rx+oqa}ux2718JwT>=z
zbe5y{IC{0C-5hP@XnjX(I9kP3JFoBenw2q&>$sI2t?lUXjvmW($<OBn&}`x8zYIv0
zlzg|>iyhtO=xRsbb#!_F;NFh@#L)(h)&!iLHNdRYFRo)&3qaY<(MueC)X}+)-Vh`}
z?mm?^hdcUB2|!{g6w}fK-Q?&yj^69&FCG1H0Me>mw#}?W1waI_?BM8NM_+KX&~zkH
zV6Om-l@e8`wAswjIT;C47dVz43=~VI|8sPzqXPra8_Xn8hs8Dax{kJWw7;X%0$6P4
z(rJqv{i~ym0f#FizyVAFIInc{%L-{zhwObRAlcvk+|ef;z0lE?j@IhFC0C3>CvWIz
zcSpxMx=6gTs-3hr>Y%$E9Wlr&sSo{Kyh2L{-akjs)CJOmfmi+eJ&wL5eyZHr(PO%6
z(&e~_S9G5gM&>6RT@#7_#WFfo=!kxPkSHV5fsr=z9bK5{;3j~R0+M}(@~{8D!qNL3
z{kfwJ2D6pf_(i<Zx~Zd=iJy*chye4Tr1cB!oUe-4U8pXl->ej#^EZwp>d>};laoX-
zfPUuaLyrE!(c=a|7n_xeB3|MBD@P|gx~>8+sm{1h{7ObwQ}M{vX^N>2WwniIY8(LB
zX>5`C-%lKUz|kI#*6p?zmZ9PrXB|fi9GwtGo$4!PfJsS;UyE0GtEQ=4#Oq33OjF|m
zNF@-U{-L9z9X(yV*`bf_nZ6=^TEYN_f_Pz&7)xbzSzFerw$lN_GjqTh6w}nf0c2fH
zQ{w_i2M<QZe{=L2M;mqAMblM6$Fj7>%6f(j>l$|DQPr7or+?1TW5Z)|)6}CKeOUae
zrcY^82S9cKaIK?{i&yF&*=>*YTORI6@yaXa`OBr4+bv+~fF|yAq}4I;vrN%x3Omp_
zQcMY50Vh_BV?$v|Z;PeR-Hy(8bcmx3yXm%mi%t<Nv7h7U(=se&${Mk*v|;MmFMwlY
zk4g&th84?|nL4_XD)zc;z@&f%VfbYEzU`nGB+J(lUWz@TwZt#6&y!(YW?aDJMlp)y
zj*{1J<^|xs(b4Y{_jf6A&|7YdfDup8@pmhMw2m)}xBaZ9@7QJEwpI*i&@0~V=ql5Y
zvGO}9X!O3brCPsX$2`_=x|B3JEu-unCSJd@W`{b90t+52=nNQKJk}2HnzCIjJH>$J
ziJ`N88@+g41-Q-#=JUkx=#fz;#Wc0GcmrYA`b`X+{}gW(2gvNZu}K>nI&(Tt3?ArO
zM@NX?Jk3em=`RK}n>+f9c%?3uGIJgAwju8jZwao_Zx%SZqzBMgiLx}b$BP0_t2)|5
zywpGv-5G%+9$={{jB6axu!H?kt{tYjm`-Bn_e?3QvvZxA%7F7LM=vO8FvK@H&dVKL
zp8;_f5(m-^S{%RD6K~X;7XY-4qoW-CI09P^JhAj)gZCsy8-=#W`XfzMF`&WH`SlXe
zG}#e+|GuN`0uNYNS2je4AORmKUeCIvC*Z`L%qnn!L{m%Pb5HU5&+UnKtpX3g{H&uV
zEEC|7VtN8J=bDab12l1Cq9AS_o}VM^H%tY6=r=LXs_Pshg@m-a84_q?@zUp472rwf
zJ%9%lVZ*5gj{yy$_8T35CT_IbLPH%Se!2YyL$7o6R`IK@JED8L297>k!Hci5?&PPG
zdQ2E>$J`j*pQ<wjo>Qezn5RqUkzqyntiW*Fph<y;&pQJ+?li>py%i1LwZu{IV9$E7
zq&F|sgzy;gJLPv}z)}VtR0Xyv){|*kZ5hy@$)6%=!(N-983zohC2gMoQmKQJ+B%Y!
zItrfc9euOL`=-Ey%?ei&-QVin&ZCO(`e8)qGO`QMSRllpsG|7ZK0sq7GApR3WPqau
zorm4=>!W(A+QeF!Ss3(gVb+mA+|b*kFz$5)n%pR>3z|Lvlj>lk4%5m0QsHYOKJf1w
z6~HM251>0BRM(%>5g($0UF7NrG+k01AWR~ay5QALS9m<GFC|h(e5B~{GOXZN0W<zi
zB<k*xcdKo`i1*At&oqFIHt33~rk?o!UGr!8Op*ToGVv=?nl?L)h>y$CaGt8^HU(JB
z0ACRwAXxgW#*28phJBV(rBH_Z6#qHNlan-kPE9dC3LNyq-0I4<{j<dT<J4{Q)Rcw9
zdY=^GINg9pyfqf{KJnH#RWn*H@0k8ayi!@^9-)7GF#Ps^JLK_-z$d;xzmv4@w00<x
z;Ge|njAd=lrYKt#i>3ZRNJ(X+)&bJ7ZD*zM0@!VkJe!)&E{JDs96tXcG(^0c9FH<~
zp3x7sGxxU5v+{{jd#w0)@{|Nr2la1D*kj5S@#c>sWq81hE0y(`EbpHoJxy7C)6=9#
z7+~EDY$MSrxKeD{BcA~1Oc@>d+KGH31)g07oY3wsmBO!S-09a2CicM|-c27YFHT?;
zMQum~@ZTIYh?3ng{)l)BEcbTVK-SOt7)eK;Dsbq?S5@&RelPGs8I~mDN*!&RUx+sa
zOy^!!3q`X{>|vxz+=$vZ?1sO~(WCkpSyFfmyh4g8CSDP8&9(>*Z)=rF9r0?ymt;IW
zCpTrOG~TYmCh50?&e$(B#G(@5;1vIQDXgYl^Qqf1yNFlLEpV*V;T=dqP^IT!KVu8w
zwh4ffY9EZZe<wa6RfjFpV{tF~=J4_lBpOhSYgkP88}v7atHeQBK1YUu6YDwXF3+m!
zK==PcrPzKL7dWXY>pVw0chnyJmCzB4ymx1SW395x<InGLH0k!t>W)5^kT~(^e`!^P
z?l;dBZwi?NI7<`HMZfw-@j(U6ytVYdavCDT6Oo{&NqVZXqv@yOb)nwg$2|8aNh`=o
zcZ3dHqoPih_!rFqII*6?^$#5FIcP{St1m30Wwj}xRRTXadoPqx(H{c``^j6x18wCV
z-evXhT$I|AqfU#JRR#b?L-Gc$72eg>wQBg>SA2T7xd6xNI@E#t1x83+eNI-w%PtTf
zb%}Q!qx<wJAo%#ac#CW-@>AlNX^adQXZ7?Bv>n?sUz1TIV2WS1aj=SiA>0?&hd=S9
z(oAevEOjn+wA-9Sjd*A0kA=?RW$q81&^IX`DN&zN0QGZGkMD55q<x)JpH}+h>WlB2
z3t8nHo7d4&IF?NW9Jb$o5i0Lv=X=~8=d#tqk`|snDbH0Brw+d<@HHiM*n@ofq@ck!
zB;E&_MyhJK)JX1|%6J}!-=-vvl{$RK5>I&Y_&J%yZw7u}hLxu#7@W~`lARv8Mu*&d
zT+pDoA0U1%EmJ-xVXW@7Q8uEQ6zTE*`<}{jd|TdA|7+^G3LF*_dyNYm5;&e7DriF5
z#4kPWeX0A$0dw7{tnX1@1?su9!6byUSN+75;&+^{F^n|@99s{r5Z8&1QjF==iVn3r
z-5=_?K2gt&GMrVktUf;3WV|86Qx~M~z>?jjur1?R+n`Cl7l!^pcx+i0G#Hl-4Gc}P
z`&u=6nEvq8$9Oki{L0M|$M_J5`J)6#;%k&R6!-<=EyG&J9-$tLXs5|=*iMcwz)FUz
zKMVK9e04$k4y5bFR-*xUWo<y#3j*$*-yk2mg?3=ite(UXA1?YO)6h+UM(0pQm1YIa
z5jxgC%jjGmkF>8;)C27zMdpW8&KaH4Is4&pHR|h%a9sah=DqFrtHN(v;bWX>igT8(
zGac46a4wJ{ivpJEM<j@F)srMG@$@_YJ0aAwTA~iE8{k|bY2ZMba^#^6zJcFjN%7Pb
z!8g0<8;OsMwMny6(=B$kr%REUqe))sh0lZszeJjqHZgE;8hU7C5AyLtn@Az`a=@X(
zj}O4f#X|!E(uHWE$dtrU;8542>JPDYi+IWZK^fK2;x@rCY{4Mp|LKcaHq}0CfYStM
zEO6+!Pl?}bEaQW8B>$0UFnf(6dsG>4#E;y4r0~yOoTy7jG!Ecvw$`{~7V##3QnRIU
zG28FBL!is`=lU5?{@u(-pDS>5%i>{|ff7DQXL~`0533X&UI84$Enz%%+a#__!9*IA
zX-PVbq-6RfmvNkyCH@YuUQ3(y#;tfI%jO<#3N#it1ir6a0UR{?%QAe}k#=weaBxY$
zwe(s8oD`s$uE?RYdbo97pCn#Vs@jl?8?)vJV)w~7x>AdLWeW`NV;F4Gu%sOX9ahCi
zkP<(w01p1Puc-l?1Ek1kl>!c6X4*Tb3ea5_@kc}6Afv#s-<fJLBdpUGlQi;?na*lT
z;^3OGe+^zpWN=M}7i+`OEb2+^U;MKEAk+A<-e#vNPRb*mdhMPG-G*okR-Q=bTN7Z3
z+XeN4IR5p*{cZ4+-tZK!cYH3x<XnNHiZN0GMXm}s2g~qCO92PV=H40LSRdav$#4pm
zm_Pj+zhPtVo#K_!BYUEw0%6qqnG8#r)PUr>9?^Jw3;fU)M?2b8Qc)t}(P|arCMAw8
z#pxVPv5^A}3hm#DkF`$mq8$xzbQ7)&IBzj^r6i91MAre_w@d-0QqScEk<uM4@PUrS
zLWCo^H%N6DhQF&b3^fHD(zEU)<u)9q7e?Ie8D1=KILxC=;vhvynq4Mw%J#7Orkq|A
z^WC&gnj$3HrV<bO&<S-C_RIx13&q=L%78;>vt++F!;5x4Ae>(zamW|U(MGpM_og~$
zNyKa4RHoD9z|#gFYUjd%e(Mx)SdLns*rtKQCkk(ALLc#IK0ahRIR_l}yq-}39O^nw
zip|0%jhZV8Y2Tr9J~IWJ4|f0@O#fR}00#~JqmrLO#sLnN@OO6z9LsZV1lu!4^|v``
zQdbhjzis-Rcm^H@&rNmMIg%gcO+1+I1du(c0yxAT{Y#=VQoz}<25`EPI5B9dejkG;
z1)4Ho)vc?E_tNR=g(LkYK2E1C;HV@!U;GAU8E{A;e|k;eOtZwni41p+9~t8MvcP-X
z*0DZgB@HVZ!hNrZ>Lcsd)lx*UwgDas98R}cIqtCEw)kLeq`3me)-`RwSz?}nWX15f
zK)h3wrTOBcFuxUnB(6*U_H*%ja=V54b`9Tm4Rx`o!I$XnOkGWo0teH^>T!p))u>kD
z;FzRKx-#ILwhRM@l_}HXdYSjr%oS{x+-&$ty(e}hjIxiHa@!Z4gTItveW%IyQs9sZ
zWsUgZ7U^wGRsSx*iK_%SoTm5L8o*)yNrT3w0XSMWMl(ica;II2TsgRU{(l8<um}@L
z`^X${q)0%Z;m~niO^^bIoILBq474TYEO5Rk;Utq1;Lr$PEdh>RV~*FjpWOKeeE|o{
z_nIl*By6OLpJH+cuIYO!aI%?5LtWTce$pavwEswlw{FZpTb9RhfrFjr>otHwLv1tz
zPUpZ`FJ@p`fU`|a;9NNa&U8qexMTVP4hF)nlmJIN2xV~F8o=qwj<Z4oC+?`Gf%6^l
z%5Sm}0w1iZK2rlYD95_0N}VjHTMoos*%OFoz!|^)R5?D@(ONMBHWgYMb{q)b-{*wq
zt(qb16X$1uW3Mra?I%UHFk6Qn=8E(>E9#782{-`$#2UasFYIDfg^TKl9p@VJ@@?&R
z@Es>~Tpciw5ixp5_{4dO45CCg+!x&&H>h5d`W55YYoogOBt0#TS-Rujw$<1Ihxf}Z
z#}zoZg_bSHmxQ_)<#=Z%ffMT7QM?7Y4Lgnn4o-2a#Sg!@CE&yjQum&!-;Tp$Tl+XE
z;NUcN$VdZ^0_U%#2n@&p2Ls_THGs1~{M6l+9ZrEWn(|k?*}6@M6Ysyo8NTeUaoO`z
zI!{@)ur5Gjfy34fR^eovlK~D{)^BSFIJ-#m(YKZt4J+C=1)Srh9k+@Vf$UTaa1N>g
z931j*sQ?aMj+psNj|LLI<#2tAz=1!U;TEJG{z@4RH*JgR0<%pX+Th(zRZRegPn@U7
z+);Yuv-s>5H?;s7`(Eh4PnCot*8(YmzuFp=RUNP-^V?~lGTvi}qf=GNOrXHw#1`w)
zngR||<j@+xA#hJxXgB*_r1euLyrGA0CdC02U35Yfc&3$dJZl5r5J2&W3g7^))N$KO
zO<fo{Uoj{@bd^BLS4rU(({%f(`toH-+2F(nUY#c1*7DN^iR|Cl7#7N~1A5g9-V^R=
zl9x$|4b@y=T>LjW`vrqc=&S(_OZHebh(U-i&ZyVjaDBLGFrEFrCE)0aip&}7rx;+n
zA7^C3Z}(}Ca9Sd8j)O|ikbIUYJDRb*usy-bW3Pt!nS=-;JVpw;OB29(O9nVr;xOQz
zS0Zh+K8@sPLort1yg_ouHc9(grbvN%X$|0DKHs+^p6U`geQcy_4me2cy+f0h0q1R!
zPnx8_!8LT363{>_)!!q2ur;mUC@)N@`;-9~vG-6WriMu~O|c#D`2<knYmN<M>8IJT
zn&xLL3VaaHeY^}ygcNW9y`F_IqMJzJ$aP$FZwffH!&57O!}bdMS$DMn9OZ*|+A+sR
z+eK4%oMafv0S8CyQW4#C5uXg|gEfGILpcUHZYu-MdlUEC4&xKQ<jtgfp9=3l2IIXg
z07n&L9P2h~xrwudMg%+@Ym-V(X0Oo`Uep((sUrS}f=|@|4pZ??lF6cBfb$_!S4!g0
zX>8DDj{pkwAPL#uiz6MH)Nhcq_46G!TogE1Lal<F0?tE5w80b|XDt5YxHBsFhKO+3
zAqSj6am?Z=;rFR5VGjlgLVQ{FoXk)UM?dR6V^hG<df<)K?aK${CV|$9W|@MB&AD01
zI{<eAQmgfH_-d+%k2Lsd1>exQj<ye-8XNBB>EERAIZ6QsVjqj?OdZv8j&Dy9uY)vc
z{Ik;(YQwX~ZLcQNlhI%R=Xv6T)p8<V8<R$RRMUJ+NGfqIkaFPgN%HS43~=H$;P3bk
zohf<X@QEduCA;oZrFeqo%Wx8^rhuc<6cHzzj02c93c$hd<`yaM00?hEvQhLRBI6=H
zFX69i@J&{SJxl7*x-?Z?Zi5qv^8v|ZXbtu7KRg_7ZWuHwaTW*g)=Nw&J~=bG$kF0+
z)x2Yl^v>{!<9J!9vAsqQ`etaDCU}^XjtYEV7&UCFvH5;a;QP36uf98<WVm{l_yks|
z)AH=KdQ5&a+!yo3-##JUox<uja|Mr`rm*^tCK@OK4v_|zgbGm7?rVq^Ng5<^quKvG
z(BShYB~7ATXQb-)9N&u)_oeF6@ASd_nYzm2&zqR0SmxJXhKrxi?Q(Ih%#<~7*>9RO
zpSQ{PlIS;8e8+XAbewVOX$m-2+95edW5p{9iX6_==pwOaUQ<-{qD?=qZJtx$nWVlZ
zc$^e8OQo2mm~loOw`xe8&Bf=;(aO38%`}3iZsT{^22DsB`y8F7NVN6XNr1zW@vu-)
z)8|%A3W_RmKMhni&GgM%6{)mY=;+0RNmsPukF&WbRMv!LGG;XAU|!{H9(Pimdb*%8
zDKM=(E9ub$@JHancn7&gz+oTc9a606n*xr0XSHxohFHzn{g?RJ_PehBa&@&$y7G*t
z^s;w<pl6<Ax;wlB%X@5X;~yOzfrp)5J&<FrQpYwb9{lV!6OD=E_A3l=O*G_rQhn?W
zgj9S@sOyzcU2W6;;kh_dsf{W&>cu?MNoNFJ<9F|ic#i|c=j|CyggpUpSemmt+Jvs7
zBAU^L;;l)RQqRQ&V^>E%kkL_Wzq9fqsvxyD)Jc&dP91m9vU4L;@x*_3({TILY~(gx
z#OIv*p=ppw!DE5*HSxy)<esVE;cU)(Du8o9-@qAo69$q;v(u-5qsr%7bML)e74dr_
z$A}lPO#p{ac67I?YC!Sv<TuJNVC?g$@BIq2j+!LqQ9beAB>4?oeQ%`Bt0nJtv3wQr
zr`G+q6w2tN;L!$U!*Jgk&&ARGX9hSifVlp808QngTx}F7Jn<M@x0?ZydT%7;i>1U>
zV!0~f=WsGZ#0P4O3m)z8n}f)%ii^hI<a-IQ*v>(D-$F9(nr#;;Jn=A^-7jh7Sf?qx
z8~0pcfI|^~!pxbHPAfm|s)}h3|KqHOTX-hZB+&);$>>z2z#-ysU+HPO3eVLvyJ{1O
z+e8&(K)&OO1|0ll2{+Y<&q=|fjmy-xNd<6tCbpzF;4EI=zFm4!kflg&6mQX_fb(tf
z+c{mc*<X<&zKCOiY{2{^3NqhWf$U!6xdg>oFSnGQ!xHy#;g(KEviRv1y+w7g#fkS;
z;1Gko{R$;<w1gKwTP8n4K!1l3kX2LFslZPbujiz;A@n=C7w2lSVtG|ZbYLKY>+o1C
z3sKR*g7SPy;Pb!^d9^%aEXDA+WrwhNc=}+3U1=JnE_ke@z{?LWwsmsAk;1q}W2eq5
zu-9}PVY&;&o6fIok*+hJfYwH3=Gwtdt=C8ObVb(%BE)(J>00uMw<zNVY0tYH2R!=w
z^QBl3<(`GFGCTD)l}G%Xx$dLQm8vA~xKg=IV%jHfVn0zN;-`>LOOXzCoM}r%_f=BF
zT9-ZRS>heMb53PTGk@=r%HF$gKDE7Zf+yBoGf(uRXNiwmBvdtJ6s&4Qh}9B~+{p}9
z;TaH-lqkUJYumSknRZI)flQ}NQCo$k?NvEv8X*nH6$wVmI#)*lFGDQSrcyp#p+MsU
z+eSK%COc?SiPQ#9@plyX=Y%Hhe?=$WTM$kC+Q48PeaAMY`haAuzT&0MGo;AJ+_%(8
z=~uaFH09*g7T>w&kTOLRIZVYKnMM_|GQuZC^9WXf$2Kg}9ELHqZ;TWv0??SQ9+0$I
zzi$9_ao;4MVVh(B(3DdF8Z9<V7T+D4%{({C;=gkbd0w)o!HHj8k$n2jo`I7Z5Ew);
zPvFdTnIWzTY`Z<v4sC%(m0@gUhYUjeewU!ATNFI_*t}1QR3?ivFP8$(@4~%$!py_<
zhPt7xLr2t2sNFVrAS}kDIwP0OhJl_Ch=IV#$M0zoJUP&?g3^uTl?KzG*QAOR=S^}1
z^hYA_)RjDpTsA+q3w3Js^Q3TJI8pL0nq7fLpNkO_DNEqm!x_8=MWTUK0^hjcUKQ?X
zlJB@J6*Nfjw}m!LW<Z^)B1Ph$HN?kHYo^g$R)*Z_gMhFDB}yz5>fT+vF4c$BiJ!%O
z+smZbnUAw{XwE;9SX(Erx$>LRXY?9N_M5do2Gb52EmEZOAm<-}_qRt47V8M{3Ph(j
zM$IV!D6316$Pp#^OBq0R4ICWh=S#Uq9{^%ME9H3Kgp{%MaTtht7%GsLog#&M1C2%=
z-kUNnnzMOW-H1_5#)zE)7^$DMx_3#l!Ghxg2at1`-;?!Sqh`?Ql@;elq#5a$0*zji
z1nETvG|OfYqmYRYzqr!8WGt>zQb-Mi`kTuGfH+eCpO%ZId#PhP3oABWe`^fVBU^Po
zl;*Q#)Xp<0XyQ85w`q@M9yF$C8n;1sF%li74jV~b>)$jWQ2z#CPL{&|r7I;l<_#(O
zM#(3N)c4+5(#~&9fCe?-bn#KQy*RS9TBJ~#iEQ||6u!$#5{;R%lkk0!jPE$s26*&4
z+bpD};}ui-jZRfBmtkM+aexy~;SZX6u%aI;J`q-#j<swT10HM}hlhrLz%;}-04fU)
z?n2_gE7Ei8@OrtEh%p}=EyD-O*5x&xw(S&&JIVo$)(OvBK0%{JM}_!R65*z-j_h$q
zWx@M7aor_o^jWNs2o}VClhSWg+B{KwhS72I5a*-}(>1Fm>|AVCDp;1SmD3!GwFYnH
z=m_zqdAnSl#1XzLX#?TGcbHV?GiGD<`_Vh)-X{eZtIM1#-T@2C^hjH-D8;5+<zV^e
ziqBkrjT9@Xl#lVW00%JaEETSo;=_V9TWM~ZN&!Zt4AT-(uVkdh9I;B(Ggp*irO(FV
z=WUj*H=2gcrIYI#H2O^RG7>93CihNZKoB!V)>M0-SruS(^~fiK=rr;EPLGxqSjyyz
zl|GCpqBn8c!n5$VrlI=+Q2ZQroZl|ht0^`&)eR)(*-BAsZr~a{hI1T<N_djiH!BrI
zip@-H6PW5*z5H5+0h9t!SHQs#IbX_C<*VH)l?dA!Hy4}#FBBgsiypIu42MV0q)eTn
z4Hf{z0co#u^ab%d%yx99^7b?dq8Kz7FPWxT2A6?`RU^rv^xO&s&SEK6SX$qY#Tzu4
zrU?L8btYlvSPXz@OicHLAfF&UK<^gQp>_l}Ii1D#qkA1zB5mw4oO2NFO@IYr3dZXZ
z9f;Jxtdw*oy~`$EzKb@fcr!kVB57A%FFrhn^Aqlo;m%$x<x|=?MmT#9fZd`7uQmmq
z5<n-lKbCVm8K358?ZHfk>83<dh?N++1WAoP89L@S2>|G*w_wUSm**5&A}o#{<n!=Y
zXR~*O-;>%6CI7?#mOmA5IbX%T%dGTN0*G+c#MVK0GKXZal)WHyUVMf^PCDg?``IGd
zzJd>kTshcpQ0!Ss6KYGchPh?(oR!uKBOjyUCZW?f=I221dqx-;u@m8dg`!PZu_g;B
zo3c=1(MKxxgv9GAIGe3Gn5~AE?Gic@Nq`cHFVD8(!-{tmf42Dx#b+-?@jWym{zhuq
zjrx9%S(&~vFHCo<XDAz@JS(#@E3+~yvob4FTmAszGjjclsW9OH0000<MNUMnLSTYs
C&$l1|

literal 0
HcmV?d00001

diff --git a/configs/decidim/assets/img/logo.svg b/configs/decidim/assets/img/logo.svg
new file mode 100644
index 0000000..e1d3dc3
--- /dev/null
+++ b/configs/decidim/assets/img/logo.svg
@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" width="128" height="128" role="img" aria-label="Wizard flying on magic wand, blue robe">
+  <!-- Original Kamek-inspired mark; not Nintendo art. No filters/transforms for clean raster. -->
+
+  <!-- motion streaks -->
+  <line x1="4" y1="64" x2="22" y2="64" stroke="#5eead4" stroke-width="2.5" stroke-linecap="round" opacity="0.55"/>
+  <line x1="6" y1="74" x2="20" y2="74" stroke="#38bdf8" stroke-width="2" stroke-linecap="round" opacity="0.45"/>
+  <line x1="8" y1="54" x2="20" y2="54" stroke="#fde68a" stroke-width="2" stroke-linecap="round" opacity="0.45"/>
+
+  <!-- ground shadow -->
+  <ellipse cx="64" cy="118" rx="30" ry="5" fill="#000" opacity="0.2"/>
+
+  <!-- ===== MAGIC WAND (mount) — diagonal, thick gold shaft ===== -->
+  <!-- sits under the rider from lower-left to upper-right -->
+  <line x1="6" y1="100" x2="108" y2="72" stroke="#92400e" stroke-width="11" stroke-linecap="round"/>
+  <line x1="6" y1="100" x2="108" y2="72" stroke="#e8a838" stroke-width="7" stroke-linecap="round"/>
+  <line x1="6" y1="100" x2="108" y2="72" stroke="#fde68a" stroke-width="2" stroke-linecap="round" opacity="0.75"/>
+
+  <!-- wand jewel (front tip) -->
+  <circle cx="112" cy="70" r="13" fill="#f59e0b" stroke="#fff7ed" stroke-width="3"/>
+  <circle cx="108" cy="66" r="4.5" fill="#fef9c3"/>
+  <!-- sparkles at tip -->
+  <polygon points="120,54 121.6,58.5 126,60 121.6,61.5 120,66 118.4,61.5 114,60 118.4,58.5" fill="#fef08a"/>
+  <polygon points="102,56 103,59 106,60 103,61 102,64 101,61 98,60 101,59" fill="#5eead4"/>
+  <circle cx="118" cy="78" r="2" fill="#bae6fd"/>
+
+  <!-- ===== RIDER on top of wand ===== -->
+  <!-- blue cape fluttering left -->
+  <path d="M38 78 C18 82, 10 98, 8 110 C22 98, 34 96, 40 92 Z" fill="#1e3a8a"/>
+  <path d="M40 80 C22 88, 14 104, 12 112 C28 100, 36 98, 42 94 Z" fill="#1d4ed8"/>
+
+  <!-- BLUE ROBE (body sitting ON shaft) -->
+  <ellipse cx="54" cy="86" rx="28" ry="22" fill="#1d4ed8"/>
+  <ellipse cx="54" cy="84" rx="24" ry="18" fill="#2563eb"/>
+  <!-- white trim -->
+  <path d="M32 74 Q54 94 76 74" fill="none" stroke="#f8fafc" stroke-width="4" stroke-linecap="round"/>
+  <path d="M36 82 Q54 98 72 82" fill="none" stroke="#e2e8f0" stroke-width="2.5" stroke-linecap="round"/>
+
+  <!-- green shell -->
+  <ellipse cx="66" cy="92" rx="13" ry="11" fill="#16a34a"/>
+  <ellipse cx="66" cy="92" rx="6" ry="5" fill="#86efac" opacity="0.75"/>
+
+  <!-- legs over the wand -->
+  <ellipse cx="42" cy="100" rx="10" ry="7" fill="#1e40af"/>
+  <ellipse cx="60" cy="102" rx="10" ry="7" fill="#1e40af"/>
+  <!-- yellow feet hanging past shaft -->
+  <ellipse cx="38" cy="106" rx="7" ry="4.5" fill="#fbbf24"/>
+  <ellipse cx="64" cy="108" rx="7" ry="4.5" fill="#fbbf24"/>
+
+  <!-- left arm forward -->
+  <ellipse cx="30" cy="82" rx="9" ry="7" fill="#1d4ed8"/>
+  <circle cx="24" cy="78" r="5.5" fill="#fbbf24"/>
+  <!-- right arm up -->
+  <ellipse cx="74" cy="74" rx="9" ry="7" fill="#1d4ed8"/>
+  <circle cx="80" cy="68" r="5.5" fill="#fbbf24"/>
+  <circle cx="82" cy="60" r="5" fill="#38bdf8"/>
+  <circle cx="81" cy="58" r="1.8" fill="#e0f2fe"/>
+
+  <!-- ===== HEAD ===== -->
+  <ellipse cx="54" cy="50" rx="26" ry="24" fill="#fbbf24"/>
+  <ellipse cx="54" cy="53" rx="21" ry="17" fill="#fcd34d"/>
+  <ellipse cx="34" cy="54" rx="6" ry="4" fill="#fb923c" opacity="0.4"/>
+  <ellipse cx="74" cy="54" rx="6" ry="4" fill="#fb923c" opacity="0.4"/>
+
+  <!-- glasses -->
+  <circle cx="42" cy="50" r="10" fill="#bae6fd" fill-opacity="0.4" stroke="#0f172a" stroke-width="3"/>
+  <circle cx="66" cy="50" r="10" fill="#bae6fd" fill-opacity="0.4" stroke="#0f172a" stroke-width="3"/>
+  <line x1="52" y1="50" x2="56" y2="50" stroke="#0f172a" stroke-width="3"/>
+  <line x1="32" y1="47" x2="24" y2="42" stroke="#0f172a" stroke-width="2.5" stroke-linecap="round"/>
+  <line x1="76" y1="47" x2="84" y2="42" stroke="#0f172a" stroke-width="2.5" stroke-linecap="round"/>
+  <circle cx="44" cy="50" r="3" fill="#0f172a"/>
+  <circle cx="68" cy="50" r="3" fill="#0f172a"/>
+  <circle cx="45.2" cy="48.8" r="1.1" fill="#fff"/>
+  <circle cx="69.2" cy="48.8" r="1.1" fill="#fff"/>
+
+  <!-- snout + mustache -->
+  <ellipse cx="54" cy="62" rx="8" ry="5" fill="#f59e0b"/>
+  <path d="M36 64 Q46 74 54 70 Q62 74 72 64 Q64 72 54 74 Q44 72 36 64 Z" fill="#f8fafc"/>
+  <path d="M44 66 Q54 74 64 66" fill="none" stroke="#92400e" stroke-width="2.2" stroke-linecap="round"/>
+
+  <!-- BLUE pointed hat -->
+  <path d="M28 44 L54 2 L80 44 Z" fill="#1d4ed8"/>
+  <path d="M36 44 L54 10 L72 44 Z" fill="#3b82f6" opacity="0.5"/>
+  <ellipse cx="54" cy="44" rx="30" ry="8" fill="#1e40af"/>
+  <ellipse cx="54" cy="42.5" rx="26" ry="5" fill="#2563eb"/>
+  <ellipse cx="54" cy="44" rx="30" ry="8" fill="none" stroke="#f8fafc" stroke-width="2.2"/>
+  <polygon points="54,12 55.6,16.8 60.5,18.4 55.6,20 54,24.8 52.4,20 47.5,18.4 52.4,16.8" fill="#f8fafc"/>
+  <polygon points="42,22 43.1,25.2 46.2,26.4 43.1,27.6 42,30.8 40.9,27.6 37.8,26.4 40.9,25.2" fill="#fef08a"/>
+  <circle cx="54" cy="4" r="6" fill="#f8fafc"/>
+</svg>
diff --git a/configs/decidim/bin/apply-branding.sh b/configs/decidim/bin/apply-branding.sh
new file mode 100755
index 0000000..6327fe3
--- /dev/null
+++ b/configs/decidim/bin/apply-branding.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Apply hacktivism colors + header CSS on the live organization.
+set -euo pipefail
+cd "${HOME}/koopa-decidim"
+set -a
+# shellcheck disable=SC1091
+source .env
+# shellcheck disable=SC1091
+source users.env
+set +a
+podman exec \
+  -e DECIDIM_HOST="${DECIDIM_HOST:-decidim.hacktivism.ch}" \
+  -e DECIDIM_SYSTEM_EMAIL \
+  -e DECIDIM_SYSTEM_PASSWORD \
+  -e DECIDIM_ADMIN_EMAIL \
+  -e DECIDIM_ADMIN_PASSWORD \
+  -e DECIDIM_ADMIN_NAME \
+  -e DECIDIM_APPLICATION_NAME \
+  -e DECIDIM_DEFAULT_LOCALE \
+  -e DECIDIM_AVAILABLE_LOCALES \
+  koopa-decidim bundle exec rails runner /code/lib/koopa_bootstrap.rb
+echo "branding applied. public: https://decidim.hacktivism.ch/"
diff --git a/configs/decidim/bin/install-systemd.sh b/configs/decidim/bin/install-systemd.sh
new file mode 100755
index 0000000..76fefab
--- /dev/null
+++ b/configs/decidim/bin/install-systemd.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Install Decidim user systemd units on koopa (boot via linger).
+set -euo pipefail
+HERE="$(cd "$(dirname "$0")" && pwd)"
+LIVE="${HOME}/koopa-decidim"
+# admin-log tree (scripts/decidim → ../..) or live ~/koopa-decidim/bin
+if [ -f "${HERE}/../../configs/decidim/container-koopa-decidim.service" ]; then
+  UNIT_SRC="${HERE}/../../configs/decidim"
+elif [ -f "${LIVE}/container-koopa-decidim.service" ]; then
+  UNIT_SRC="${LIVE}"
+else
+  echo "ERROR: decidim unit files not found" >&2
+  exit 1
+fi
+UNIT_DIR="${HOME}/.config/systemd/user"
+
+mkdir -p "${UNIT_DIR}"
+cp "${UNIT_SRC}/container-koopa-decidim-db.service" "${UNIT_DIR}/"
+cp "${UNIT_SRC}/container-koopa-decidim.service" "${UNIT_DIR}/"
+
+systemctl --user daemon-reload
+systemctl --user enable \
+  container-koopa-decidim-db.service \
+  container-koopa-decidim.service
+
+if ! podman ps --format '{{.Names}}' | grep -qx koopa-decidim; then
+  (cd "${HOME}/koopa-decidim" && set -a && source .env && set +a && podman-compose up -d)
+fi
+
+systemctl --user start \
+  container-koopa-decidim-db.service \
+  container-koopa-decidim.service
+
+systemctl --user --no-pager --lines=0 status \
+  container-koopa-decidim-db.service \
+  container-koopa-decidim.service || true
+
+echo "OK. Public: https://decidim.hacktivism.ch/"
diff --git a/configs/decidim/bin/seed-example.sh b/configs/decidim/bin/seed-example.sh
new file mode 100755
index 0000000..51f1dba
--- /dev/null
+++ b/configs/decidim/bin/seed-example.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Publish public example process/meeting + optional isoc user from users.env.
+set -euo pipefail
+cd "${HOME}/koopa-decidim"
+set -a
+# shellcheck disable=SC1091
+source .env
+# shellcheck disable=SC1091
+source users.env
+set +a
+
+src=""
+if [ -f "${HOME}/src/koopa/koopa-admin-log/configs/decidim/seed_example.rb" ]; then
+  src="${HOME}/src/koopa/koopa-admin-log/configs/decidim/seed_example.rb"
+elif [ -f ./seed_example.rb ]; then
+  src="./seed_example.rb"
+else
+  echo "ERROR: seed_example.rb not found" >&2
+  exit 1
+fi
+podman cp "${src}" koopa-decidim:/code/lib/koopa_seed_example.rb
+
+avatar_host="${DECIDIM_ISOC_AVATAR:-${HOME}/koopa-decidim/assets/img/isoc-gold.png}"
+avatar_ctr=""
+if [ -f "${avatar_host}" ]; then
+  avatar_ctr="/tmp/isoc-gold.png"
+  podman cp "${avatar_host}" "koopa-decidim:${avatar_ctr}"
+fi
+
+podman exec \
+  -e DECIDIM_HOST="${DECIDIM_HOST:-decidim.hacktivism.ch}" \
+  -e DECIDIM_ADMIN_EMAIL \
+  -e DECIDIM_ISOC_EMAIL \
+  -e DECIDIM_ISOC_PASSWORD \
+  -e DECIDIM_ISOC_NAME \
+  -e DECIDIM_ISOC_NICKNAME \
+  -e DECIDIM_ISOC_AVATAR="${avatar_ctr}" \
+  koopa-decidim bundle exec rails runner /code/lib/koopa_seed_example.rb
+echo "seed done. public: https://decidim.hacktivism.ch/processes/example"
diff --git a/configs/decidim/bin/up.sh b/configs/decidim/bin/up.sh
new file mode 100755
index 0000000..21a6a9d
--- /dev/null
+++ b/configs/decidim/bin/up.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+set -euo pipefail
+DIR="${HOME}/koopa-decidim"
+cd "${DIR}"
+set -a
+# shellcheck disable=SC1091
+source .env
+set +a
+podman-compose up -d
+echo "== wait for :9027 =="
+ok=0
+for i in $(seq 1 80); do
+  code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 5 "http://127.0.0.1:9027/" || true)
+  echo "try $i: $code"
+  case "$code" in
+    2*|3*) ok=1; break ;;
+  esac
+  sleep 5
+done
+[[ "$ok" -eq 1 ]] || { echo "ERROR: no answer on 9027"; podman-compose ps; exit 1; }
+echo "local ok. public: https://decidim.hacktivism.ch/"
diff --git a/configs/decidim/bootstrap.rb b/configs/decidim/bootstrap.rb
new file mode 100644
index 0000000..8ec96a1
--- /dev/null
+++ b/configs/decidim/bootstrap.rb
@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+# Create system admin + organization + org admin. Idempotent.
+# Usage: bundle exec rails runner /code/lib/koopa_bootstrap.rb
+
+host = ENV.fetch("DECIDIM_HOST", "decidim.hacktivism.ch")
+sys_email = ENV.fetch("DECIDIM_SYSTEM_EMAIL")
+sys_password = ENV.fetch("DECIDIM_SYSTEM_PASSWORD")
+admin_email = ENV.fetch("DECIDIM_ADMIN_EMAIL")
+admin_password = ENV.fetch("DECIDIM_ADMIN_PASSWORD")
+admin_name = ENV.fetch("DECIDIM_ADMIN_NAME", "hacktivism")
+org_name = ENV.fetch("DECIDIM_APPLICATION_NAME", "hacktivism")
+
+sys = Decidim::System::Admin.find_or_initialize_by(email: sys_email)
+sys.password = sys_password
+sys.password_confirmation = sys_password
+sys.save!
+puts "system admin: #{sys.email}"
+
+org = Decidim::Organization.find_by(host: host)
+if org.nil?
+  attrs = {
+    host: host,
+    default_locale: ENV.fetch("DECIDIM_DEFAULT_LOCALE", "en"),
+    available_locales: ENV.fetch("DECIDIM_AVAILABLE_LOCALES", "en,de,fr").split(","),
+    reference_prefix: "HCK",
+    time_zone: "Europe/Zurich",
+    users_registration_mode: "enabled",
+    force_users_to_authenticate_before_access_organization: false,
+    available_authorizations: [],
+    tos_version: Time.current,
+    colors: {
+      "primary" => "#e8a838",
+      "secondary" => "#3ecfbf",
+      "tertiary" => "#3d3128",
+      "success" => "#16a34a",
+      "warning" => "#f0d090",
+      "alert" => "#e7131a"
+    },
+    header_snippets: %(<link rel="stylesheet" href="/hacktivism.css"><script src="/hacktivism-consent.js"></script><link rel="icon" href="/hacktivism-favicon.svg">)
+  }
+  name_val = { "en" => org_name, "de" => org_name, "fr" => org_name }
+  desc_val = { "en" => "hacktivism participatory platform", "de" => "hacktivism Partizipationsplattform", "fr" => "plateforme participative hacktivism" }
+  begin
+    org = Decidim::Organization.new(attrs.merge(name: name_val, description: desc_val))
+    org.save!
+  rescue StandardError
+    org = Decidim::Organization.new(attrs.merge(name: org_name, description: "hacktivism participatory platform"))
+    org.save!
+  end
+  Decidim::System::CreateDefaultPages.call(org) if defined?(Decidim::System::CreateDefaultPages)
+  Decidim::System::CreateDefaultContentBlocks.call(org) if defined?(Decidim::System::CreateDefaultContentBlocks)
+  puts "organization created host=#{org.host}"
+else
+  org.colors = {
+    "primary" => "#e8a838",
+    "secondary" => "#3ecfbf",
+    "tertiary" => "#3d3128",
+    "success" => "#16a34a",
+    "warning" => "#f0d090",
+    "alert" => "#e7131a"
+  }
+  org.header_snippets = %(<link rel="stylesheet" href="/hacktivism.css"><script src="/hacktivism-consent.js"></script><link rel="icon" href="/hacktivism-favicon.svg">)
+  org.save!
+  puts "organization updated host=#{org.host}"
+end
+
+user = Decidim::User.find_or_initialize_by(email: admin_email, organization: org)
+user.name = admin_name
+user.nickname = admin_name.downcase.gsub(/[^a-z0-9_]/, "")[0, 20]
+user.password = admin_password
+user.password_confirmation = admin_password
+user.admin = true
+user.confirmed_at ||= Time.current
+user.tos_agreement = true
+user.accepted_tos_version = org.tos_version
+user.locale = org.default_locale
+user.save!
+puts "org admin: #{user.email}"
diff --git a/configs/decidim/compose.yml b/configs/decidim/compose.yml
new file mode 100644
index 0000000..980f990
--- /dev/null
+++ b/configs/decidim/compose.yml
@@ -0,0 +1,131 @@
+# koopa-decidim — Decidim behind host Caddy on :9027
+# Docs: https://docs.decidim.org/en/develop/install/
+# Image: official pre-generated app (core modules only). No secrets in this file.
+
+x-logging: &default-logging
+  driver: "json-file"
+  options:
+    max-size: "50m"
+    max-file: "4"
+
+x-app-env: &app-env
+  RAILS_ENV: production
+  RAILS_SERVE_STATIC_FILES: "true"
+  RAILS_LOG_TO_STDOUT: "true"
+  DATABASE_URL: postgres://decidim:${POSTGRES_PASSWORD}@postgres:5432/decidim
+  REDIS_URL: redis://redis:6379/0
+  SECRET_KEY_BASE: ${SECRET_KEY_BASE}
+  DECIDIM_APPLICATION_NAME: ${DECIDIM_APPLICATION_NAME:-hacktivism}
+  DECIDIM_MAILER_SENDER: ${DECIDIM_MAILER_SENDER:-noreply@hacktivism.ch}
+  DECIDIM_AVAILABLE_LOCALES: ${DECIDIM_AVAILABLE_LOCALES:-en,de,fr}
+  DECIDIM_DEFAULT_LOCALE: ${DECIDIM_DEFAULT_LOCALE:-en}
+  SMTP_ADDRESS: ${SMTP_ADDRESS:-127.0.0.1}
+  SMTP_DOMAIN: ${SMTP_DOMAIN:-hacktivism.ch}
+  SMTP_USERNAME: ${SMTP_USERNAME:-unused}
+  SMTP_PASSWORD: ${SMTP_PASSWORD:-unused}
+  SMTP_PORT: ${SMTP_PORT:-25}
+  SMTP_AUTHENTICATION: ${SMTP_AUTHENTICATION:-plain}
+  QUEUE_ADAPTER: ${QUEUE_ADAPTER:-sidekiq}
+
+services:
+  decidim:
+    image: docker.io/decidim/decidim:0.30.8
+    container_name: koopa-decidim
+    hostname: decidim
+    ports:
+      - "9027:3000"
+    env_file:
+      - .env
+    environment:
+      <<: *app-env
+    volumes:
+      - ./entrypoint.sh:/usr/local/bin/koopa-decidim-entrypoint.sh:ro
+      - ./theme/hacktivism.rb:/code/config/initializers/hacktivism.rb:ro
+      - ./theme/hacktivism.css:/code/public/hacktivism.css:ro
+      - ./bootstrap.rb:/code/lib/koopa_bootstrap.rb:ro
+      - ./assets/img/logo.svg:/code/public/hacktivism-logo.svg:ro
+      - ./assets/img/favicon.svg:/code/public/hacktivism-favicon.svg:ro
+      - decidim-storage:/code/storage
+      - decidim-uploads:/code/public/uploads
+      - decidim-tmp:/code/tmp
+    entrypoint: ["/bin/bash", "/usr/local/bin/koopa-decidim-entrypoint.sh"]
+    command: ["bundle", "exec", "rails", "s", "-b", "0.0.0.0", "-p", "3000"]
+    restart: unless-stopped
+    logging: *default-logging
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    labels:
+      org.hacktivism.service: decidim
+      org.hacktivism.host_port: "9027"
+      org.hacktivism.site: decidim.hacktivism.ch
+      org.hacktivism.managed_by: koopa-admin
+
+  sidekiq:
+    image: docker.io/decidim/decidim:0.30.8
+    container_name: koopa-decidim-sidekiq
+    hostname: sidekiq
+    env_file:
+      - .env
+    environment:
+      <<: *app-env
+    volumes:
+      - ./entrypoint.sh:/usr/local/bin/koopa-decidim-entrypoint.sh:ro
+      - ./theme/hacktivism.rb:/code/config/initializers/hacktivism.rb:ro
+      - decidim-storage:/code/storage
+      - decidim-uploads:/code/public/uploads
+      - decidim-tmp:/code/tmp
+    entrypoint: ["/bin/bash", "/usr/local/bin/koopa-decidim-entrypoint.sh"]
+    command: ["bundle", "exec", "sidekiq", "-C", "config/sidekiq.yml"]
+    restart: unless-stopped
+    logging: *default-logging
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    labels:
+      org.hacktivism.service: decidim
+      org.hacktivism.managed_by: koopa-admin
+
+  postgres:
+    image: docker.io/library/postgres:16-alpine
+    container_name: koopa-decidim-db
+    hostname: postgres
+    environment:
+      - POSTGRES_USER=decidim
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DB=decidim
+    volumes:
+      - decidim-db:/var/lib/postgresql/data
+    restart: unless-stopped
+    logging: *default-logging
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U decidim -d decidim"]
+      interval: 5s
+      timeout: 5s
+      retries: 12
+    labels:
+      org.hacktivism.service: decidim
+      org.hacktivism.managed_by: koopa-admin
+
+  redis:
+    image: docker.io/library/redis:7-alpine
+    container_name: koopa-decidim-redis
+    hostname: redis
+    volumes:
+      - decidim-redis:/data
+    restart: unless-stopped
+    logging: *default-logging
+    labels:
+      org.hacktivism.service: decidim
+      org.hacktivism.managed_by: koopa-admin
+
+volumes:
+  decidim-db:
+  decidim-redis:
+  decidim-storage:
+  decidim-uploads:
+  decidim-tmp:
diff --git a/configs/decidim/container-koopa-decidim-db.service b/configs/decidim/container-koopa-decidim-db.service
new file mode 100644
index 0000000..c15c8c6
--- /dev/null
+++ b/configs/decidim/container-koopa-decidim-db.service
@@ -0,0 +1,21 @@
+# user systemd — Decidim postgres + redis
+[Unit]
+Description=Decidim postgres/redis (koopa-decidim-db)
+Wants=network-online.target
+After=network-online.target
+RequiresMountsFor=%t/containers
+
+[Service]
+Environment=PODMAN_SYSTEMD_UNIT=%n
+Restart=on-failure
+RestartSec=20
+TimeoutStartSec=300
+TimeoutStopSec=120
+WorkingDirectory=/home/hernani/koopa-decidim
+ExecStart=/bin/bash -lc 'set -a && source .env && set +a && /usr/bin/podman-compose up -d postgres redis'
+ExecStop=/usr/bin/podman stop -t 30 koopa-decidim-db koopa-decidim-redis
+Type=oneshot
+RemainAfterExit=yes
+
+[Install]
+WantedBy=default.target
diff --git a/configs/decidim/container-koopa-decidim.service b/configs/decidim/container-koopa-decidim.service
new file mode 100644
index 0000000..c84ec49
--- /dev/null
+++ b/configs/decidim/container-koopa-decidim.service
@@ -0,0 +1,21 @@
+# user systemd — Decidim stack (app + sidekiq)
+[Unit]
+Description=Decidim stack (koopa-decidim)
+Wants=network-online.target container-koopa-decidim-db.service
+After=network-online.target container-koopa-decidim-db.service
+RequiresMountsFor=%t/containers
+
+[Service]
+Environment=PODMAN_SYSTEMD_UNIT=%n
+Restart=on-failure
+RestartSec=20
+TimeoutStartSec=600
+TimeoutStopSec=120
+WorkingDirectory=/home/hernani/koopa-decidim
+ExecStart=/bin/bash -lc 'set -a && source .env && set +a && /usr/bin/podman-compose up -d'
+ExecStop=/usr/bin/podman stop -t 30 koopa-decidim koopa-decidim-sidekiq
+Type=oneshot
+RemainAfterExit=yes
+
+[Install]
+WantedBy=default.target
diff --git a/configs/decidim/entrypoint.sh b/configs/decidim/entrypoint.sh
new file mode 100755
index 0000000..b7af36d
--- /dev/null
+++ b/configs/decidim/entrypoint.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+# Wait for Postgres, migrate, then exec CMD (rails or sidekiq).
+set -euo pipefail
+
+export RAILS_ENV="${RAILS_ENV:-production}"
+
+echo "koopa-decidim: waiting for postgres..."
+i=0
+until bundle exec rails runner 'ActiveRecord::Base.connection.execute("SELECT 1")' >/dev/null 2>&1; do
+  i=$((i + 1))
+  if [ "$i" -ge 60 ]; then
+    echo "koopa-decidim: postgres not ready after ${i} tries" >&2
+    exit 1
+  fi
+  sleep 3
+done
+
+echo "koopa-decidim: db:prepare"
+bundle exec rails db:prepare
+
+echo "koopa-decidim: exec $*"
+exec "$@"
diff --git a/configs/decidim/seed_example.rb b/configs/decidim/seed_example.rb
new file mode 100644
index 0000000..e51525c
--- /dev/null
+++ b/configs/decidim/seed_example.rb
@@ -0,0 +1,247 @@
+# frozen_string_literal: true
+# Public process + meeting + page + proposal (readable without an account).
+# Optional participant from env: DECIDIM_ISOC_EMAIL / DECIDIM_ISOC_PASSWORD.
+# Optional avatar: DECIDIM_ISOC_AVATAR (PNG path inside the container).
+# Usage: bundle exec rails runner /code/lib/koopa_seed_example.rb
+
+def t(en, de, fr)
+  { "en" => en, "de" => de, "fr" => fr }
+end
+
+def fail_model!(record)
+  raise "#{record.class}: #{record.errors.full_messages.join("; ")}"
+end
+
+host = ENV.fetch("DECIDIM_HOST", "decidim.hacktivism.ch")
+org = Decidim::Organization.find_by!(host: host)
+admin = Decidim::User.find_by!(email: ENV.fetch("DECIDIM_ADMIN_EMAIL"), organization: org)
+
+org.update!(force_users_to_authenticate_before_access_organization: false)
+
+slug = "example"
+process = Decidim::ParticipatoryProcess.find_or_initialize_by(organization: org, slug: slug)
+process.assign_attributes(
+  title: t(
+    "Public digital commons",
+    "Öffentliche digitale Allmende",
+    "Communs numériques publics"
+  ),
+  subtitle: t(
+    "Which self-hosted services stay readable without an account?",
+    "Welche selbst gehosteten Dienste bleiben ohne Konto lesbar?",
+    "Quels services auto-hébergés restent lisibles sans compte ?"
+  ),
+  short_description: t(
+    "<p>hacktivism.ch already runs Lemmy, Bonfire, Castopod and Decidim. This process asks what must stay readable without a login — and what may require an account to write.</p>",
+    "<p>hacktivism.ch betreibt bereits Lemmy, Bonfire, Castopod und Decidim. Dieser Prozess fragt, was ohne Anmeldung lesbar bleiben muss — und wofür ein Konto zum Schreiben reicht.</p>",
+    "<p>hacktivism.ch fait déjà tourner Lemmy, Bonfire, Castopod et Decidim. Ce processus demande ce qui doit rester lisible sans compte — et ce qui peut exiger un compte pour écrire.</p>"
+  ),
+  description: t(
+    "<p>Reading civic material should not depend on creating an account. Writing (proposals, comments, votes) can.</p>" \
+    "<p>Concrete questions:</p><ul>" \
+    "<li>Process pages, meetings and last activities stay public.</li>" \
+    "<li>No third-party trackers; cookies only what the software needs.</li>" \
+    "<li>Which other stacks on hacktivism.ch (Lemmy feeds, Castopod episodes, Bonfire public posts) follow the same rule.</li>" \
+    "</ul><p>Anyone can read this process. Sign in only to take part.</p>",
+    "<p>Öffentliches Beteiligungsmaterial soll ohne Konto lesbar sein. Schreiben (Vorschläge, Kommentare, Stimmen) kann ein Konto brauchen.</p>" \
+    "<p>Konkrete Fragen:</p><ul>" \
+    "<li>Prozessseiten, Treffen und letzte Aktivitäten bleiben öffentlich.</li>" \
+    "<li>Keine Drittanbieter-Tracker; Cookies nur, was die Software braucht.</li>" \
+    "<li>Welche anderen Dienste auf hacktivism.ch (Lemmy, Castopod, Bonfire) derselben Regel folgen.</li>" \
+    "</ul><p>Lesen ohne Anmeldung. Anmelden nur zum Mitmachen.</p>",
+    "<p>Lire du matériel civique ne doit pas exiger un compte. Écrire (propositions, commentaires, votes) peut le faire.</p>" \
+    "<p>Questions concrètes :</p><ul>" \
+    "<li>Pages de processus, rencontres et dernières activités restent publiques.</li>" \
+    "<li>Pas de traqueurs tiers ; cookies uniquement pour le logiciel.</li>" \
+    "<li>Quels autres services sur hacktivism.ch (Lemmy, Castopod, Bonfire) suivent la même règle.</li>" \
+    "</ul><p>Lecture sans compte. Connexion seulement pour participer.</p>"
+  ),
+  start_date: Date.current,
+  end_date: Date.current + 180,
+  published_at: process.published_at || Time.current,
+  private_space: false,
+  promoted: true,
+  scopes_enabled: false,
+  weight: 1
+)
+process.save || fail_model!(process)
+puts "process id=#{process.id} slug=#{process.slug} published=#{process.published_at}"
+
+step = process.steps.find_or_initialize_by(position: 1)
+step.assign_attributes(
+  title: t("Open discussion", "Offene Diskussion", "Discussion ouverte"),
+  description: t(
+    "<p>Collect positions on public-by-default reading. No decision this step.</p>",
+    "<p>Positionen zum Lesen ohne Konto sammeln. In dieser Phase keine Entscheidung.</p>",
+    "<p>Recueillir les positions sur la lecture sans compte. Pas de décision à cette étape.</p>"
+  ),
+  start_date: Date.current,
+  end_date: Date.current + 180,
+  active: true
+)
+step.save || fail_model!(step)
+puts "step id=#{step.id} active=#{step.active}"
+
+pages = Decidim::Component.find_or_initialize_by(
+  participatory_space: process,
+  manifest_name: "pages"
+)
+pages.assign_attributes(
+  name: t("Background", "Hintergrund", "Contexte"),
+  published_at: pages.published_at || Time.current,
+  visible: true,
+  weight: 0
+)
+pages.save || fail_model!(pages)
+page = Decidim::Pages::Page.find_or_initialize_by(component: pages)
+page.body = t(
+  "<p>ISOC-style public-interest internet: people should inspect how a civic tool works without first handing over an identity.</p>" \
+  "<p>On this instance the stock cookie banner is hidden; only essential consent is set. The same idea applies to participation spaces: the text of a process is not a privilege of registered users.</p>" \
+  "<p>This page is part of that argument. It is published on purpose.</p>",
+  "<p>Internet im öffentlichen Interesse: man soll sehen können, wie ein Beteiligungswerkzeug arbeitet, ohne zuerst eine Identität abzugeben.</p>" \
+  "<p>Auf dieser Instanz ist der Vorrats-Cookie-Banner ausgeblendet; es gilt nur essential. Dieselbe Idee gilt für Beteiligungsräume: der Text eines Prozesses ist kein Privileg registrierter Konten.</p>" \
+  "<p>Diese Seite ist absichtlich öffentlich.</p>",
+  "<p>Internet d'intérêt public : on doit pouvoir voir comment un outil civique fonctionne sans d'abord céder une identité.</p>" \
+  "<p>Ici, la bannière cookies par défaut est masquée ; seul l'essentiel est posé. Même idée pour les espaces de participation : le texte d'un processus n'est pas un privilège des comptes.</p>" \
+  "<p>Cette page est publique volontairement.</p>"
+)
+page.save || fail_model!(page)
+puts "pages component id=#{pages.id} page=#{page.id}"
+
+meetings = Decidim::Component.find_or_initialize_by(
+  participatory_space: process,
+  manifest_name: "meetings"
+)
+meetings.assign_attributes(
+  name: t("Meetings", "Treffen", "Rencontres"),
+  published_at: meetings.published_at || Time.current,
+  visible: true,
+  weight: 1
+)
+meetings.save || fail_model!(meetings)
+puts "meetings component id=#{meetings.id} published=#{meetings.published_at}"
+
+start_at = Time.current.utc.change(hour: 18, min: 0) + 7.days
+finish_at = start_at + 2.hours
+meeting = Decidim::Meetings::Meeting.find_or_initialize_by(
+  component: meetings,
+  author: admin
+)
+meeting.title = t(
+  "Open session: reading without an account",
+  "Offene Runde: Lesen ohne Konto",
+  "Séance ouverte : lire sans compte"
+)
+meeting.assign_attributes(
+  description: t(
+    "<p>Public agenda (no registration to read):</p><ol>" \
+    "<li>What is already public on hacktivism.ch (Lemmy, Decidim, Castopod).</li>" \
+    "<li>Privacy by default — no tracker banner as a gate.</li>" \
+    "<li>Where login is justified (writing, admin).</li>" \
+    "</ol><p>Online / public. Signing in is optional.</p>",
+    "<p>Öffentliche Traktanden (Lesen ohne Anmeldung):</p><ol>" \
+    "<li>Was auf hacktivism.ch schon öffentlich ist (Lemmy, Decidim, Castopod).</li>" \
+    "<li>Privatsphäre als Vorgabe — kein Tracker-Banner als Tür.</li>" \
+    "<li>Wo ein Login gerechtfertigt ist (Schreiben, Admin).</li>" \
+    "</ol><p>Online / öffentlich. Anmelden ist freiwillig.</p>",
+    "<p>Ordre du jour public (lecture sans inscription) :</p><ol>" \
+    "<li>Ce qui est déjà public sur hacktivism.ch (Lemmy, Decidim, Castopod).</li>" \
+    "<li>Vie privée par défaut — pas de bannière traqueur comme porte.</li>" \
+    "<li>Où un compte se justifie (écriture, admin).</li>" \
+    "</ol><p>En ligne / public. Connexion facultative.</p>"
+  ),
+  start_time: meeting.start_time || start_at,
+  end_time: meeting.end_time || finish_at,
+  address: "hacktivism.ch",
+  location: t("Online, public stream notes", "Online, öffentliche Notizen", "En ligne, notes publiques"),
+  location_hints: t(
+    "No ticket. Page stays readable if you do not attend.",
+    "Kein Ticket. Die Seite bleibt lesbar, wenn man nicht teilnimmt.",
+    "Pas de billet. La page reste lisible sans y assister."
+  ),
+  type_of_meeting: "in_person",
+  registration_type: "registration_disabled",
+  registrations_enabled: false,
+  private_meeting: false,
+  transparent: true,
+  published_at: meeting.published_at || Time.current,
+  comments_enabled: true
+)
+meeting.save || fail_model!(meeting)
+puts "meeting id=#{meeting.id} published=#{meeting.published_at} start=#{meeting.start_time}"
+
+proposals = Decidim::Component.find_or_initialize_by(
+  participatory_space: process,
+  manifest_name: "proposals"
+)
+proposals.assign_attributes(
+  name: t("Proposals", "Vorschläge", "Propositions"),
+  published_at: proposals.published_at || Time.current,
+  visible: true,
+  weight: 2
+)
+proposals.save || fail_model!(proposals)
+
+proposal = Decidim::Proposals::Proposal.find_or_initialize_by(component: proposals)
+if proposal.new_record? || proposal.title.blank?
+  proposal.title = t(
+    "Keep public processes readable without login",
+    "Öffentliche Prozesse ohne Anmeldung lesbar halten",
+    "Garder les processus publics lisibles sans connexion"
+  )
+  proposal.body = t(
+    "<p>Decide as a standing rule: published process pages, meetings and this proposal list stay readable without an account. Login is only for creating or endorsing proposals, commenting, and administration.</p>",
+    "<p>Als Regel festhalten: veröffentlichte Prozessseiten, Treffen und diese Vorschlagsliste bleiben ohne Konto lesbar. Login nur zum Erstellen oder Unterstützen von Vorschlägen, Kommentieren und für die Administration.</p>",
+    "<p>En faire une règle : les pages de processus publiées, les rencontres et cette liste de propositions restent lisibles sans compte. Connexion seulement pour créer ou soutenir, commenter, et pour l'administration.</p>"
+  )
+  proposal.add_coauthor(admin)
+  proposal.published_at = Time.current
+end
+proposal.save || fail_model!(proposal)
+puts "proposal id=#{proposal.id} published=#{proposal.published_at}"
+
+block = Decidim::ContentBlock.find_or_initialize_by(
+  organization: org,
+  scope_name: "homepage",
+  manifest_name: "highlighted_processes"
+)
+block.weight ||= 45
+block.published_at ||= Time.current
+block.save || fail_model!(block)
+puts "homepage highlighted_processes published=#{block.published_at}"
+
+isoc_email = ENV["DECIDIM_ISOC_EMAIL"].to_s.strip
+isoc_password = ENV["DECIDIM_ISOC_PASSWORD"].to_s
+if isoc_email.empty? || isoc_password.empty?
+  puts "isoc user skipped (DECIDIM_ISOC_EMAIL / DECIDIM_ISOC_PASSWORD unset)"
+else
+  isoc = Decidim::User.find_or_initialize_by(email: isoc_email, organization: org)
+  isoc.name = ENV.fetch("DECIDIM_ISOC_NAME", "isoc")
+  isoc.nickname = ENV.fetch("DECIDIM_ISOC_NICKNAME", "isoc")
+  isoc.password = isoc_password
+  isoc.password_confirmation = isoc_password
+  isoc.admin = false
+  isoc.confirmed_at ||= Time.current
+  isoc.tos_agreement = true
+  isoc.accepted_tos_version = org.tos_version
+  isoc.locale = org.default_locale
+  isoc.save || fail_model!(isoc)
+  avatar_path = ENV["DECIDIM_ISOC_AVATAR"].to_s
+  if !avatar_path.empty? && File.file?(avatar_path)
+    isoc.avatar.purge if isoc.avatar.attached?
+    isoc.avatar.attach(
+      io: File.open(avatar_path, "rb"),
+      filename: "isoc-gold.png",
+      content_type: "image/png"
+    )
+    isoc.save || fail_model!(isoc)
+    puts "isoc avatar attached from #{avatar_path} blob=#{isoc.avatar.blob&.byte_size}"
+  else
+    puts "isoc avatar skipped (DECIDIM_ISOC_AVATAR missing)"
+  end
+  puts "isoc user id=#{isoc.id} email=#{isoc.email} nick=#{isoc.nickname} admin=#{isoc.admin} confirmed=#{isoc.confirmed_at}"
+end
+
+puts "public process: https://#{host}/processes/#{process.slug}"
+puts "public meeting: https://#{host}/processes/#{process.slug}/f/#{meetings.id}/meetings/#{meeting.id}"
+puts "public proposal: https://#{host}/processes/#{process.slug}/f/#{proposals.id}/proposals/#{proposal.id}"
diff --git a/configs/decidim/theme/hacktivism-consent.js b/configs/decidim/theme/hacktivism-consent.js
new file mode 100644
index 0000000..796f5d7
--- /dev/null
+++ b/configs/decidim/theme/hacktivism-consent.js
@@ -0,0 +1,10 @@
+/* Essential-only consent; banner hidden via CSS. */
+(function () {
+  var name = "decidim-consent";
+  if (document.cookie.indexOf(name + "=") !== -1) return;
+  document.cookie =
+    name +
+    "=" +
+    encodeURIComponent(JSON.stringify({ essential: true })) +
+    "; path=/; max-age=31536000; SameSite=Lax";
+})();
diff --git a/configs/decidim/theme/hacktivism.css b/configs/decidim/theme/hacktivism.css
new file mode 100644
index 0000000..f38e96d
--- /dev/null
+++ b/configs/decidim/theme/hacktivism.css
@@ -0,0 +1,98 @@
+/* hacktivism — same palette as bonfire/git/lemmy (exchange-dark) */
+:root,
+html {
+  --primary: #e8a838;
+  --primary-rgb: 232, 168, 56;
+  --secondary: #3ecfbf;
+  --secondary-rgb: 62, 207, 191;
+  --tertiary: #3d3128;
+  --success: #16a34a;
+  --warning: #f0d090;
+  --alert: #e7131a;
+  --highlight: #e8a838;
+}
+
+html,
+body {
+  background-color: #1a1410 !important;
+  background-image:
+    radial-gradient(ellipse 90% 55% at 50% 108%, rgba(26, 107, 110, 0.35) 0%, transparent 55%),
+    radial-gradient(circle 420px at 12% 18%, rgba(232, 168, 56, 0.22) 0%, transparent 62%),
+    linear-gradient(165deg, #2c1e14 0%, #1a1410 38%, #12181a 72%, #0e1c1e 100%) !important;
+  background-attachment: fixed !important;
+  color: #fff6e8 !important;
+}
+
+a {
+  color: #e8a838 !important;
+}
+a:hover {
+  color: #f0d090 !important;
+}
+
+.title-bar,
+.main-bar,
+.navbar,
+.topbar,
+header.header,
+.main-nav,
+.footer,
+.mini-footer,
+.off-canvas,
+.sidebar {
+  background-color: #14110e !important;
+  color: #fff6e8 !important;
+  border-color: #2a2018 !important;
+}
+
+.card,
+.card__content,
+.callout,
+.flash,
+.dialog,
+.reveal,
+.accordion-item,
+.comment-thread,
+.process-header,
+.hero,
+.home-section {
+  background-color: #221c16 !important;
+  color: #fff6e8 !important;
+  border-color: #2a2018 !important;
+}
+
+.button,
+.button.primary,
+.button--sc,
+input[type="submit"].button {
+  background-color: #e8a838 !important;
+  border-color: #e8a838 !important;
+  color: #1a1410 !important;
+}
+
+.button.secondary {
+  background-color: #3d3128 !important;
+  border-color: #3d3128 !important;
+  color: #fff6e8 !important;
+}
+
+h1, h2, h3, h4, h5, h6,
+.title-bar__title,
+.card__title {
+  color: #f0c86a !important;
+}
+
+input,
+textarea,
+select,
+.input-group-field {
+  background-color: #221c16 !important;
+  color: #fff6e8 !important;
+  border-color: #3d3128 !important;
+}
+
+/* No third-party trackers; hide stock GDPR banner (privacy by default). */
+#dc-dialog-wrapper,
+.cookies__container {
+  display: none !important;
+}
diff --git a/configs/decidim/theme/hacktivism.rb b/configs/decidim/theme/hacktivism.rb
new file mode 100644
index 0000000..762e5d8
--- /dev/null
+++ b/configs/decidim/theme/hacktivism.rb
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+# hacktivism theme + host allowlist for decidim.hacktivism.ch
+
+Rails.application.config.hosts << "decidim.hacktivism.ch"
+Rails.application.config.hosts << "127.0.0.1"
+Rails.application.config.hosts << "localhost"
+
+if Rails.application.config.respond_to?(:assume_ssl=)
+  Rails.application.config.assume_ssl = true
+end
+
+Decidim.configure do |config|
+  config.enable_html_header_snippets = true if config.respond_to?(:enable_html_header_snippets=)
+end
diff --git a/configs/ports.md b/configs/ports.md
index f8bdc8d..872d09c 100644
--- a/configs/ports.md
+++ b/configs/ports.md
@@ -18,12 +18,13 @@
 | **9024** | podman **`koopa-forgejo`** (HTTP) → Caddy **`git.hacktivism.ch`** |
 | **9025** | podman **`koopa-paivana`** (paivana-httpd) → Caddy **`paivana.hacktivism.ch`** |
 | **9026** | podman **`koopa-lemmy-proxy`** → Caddy **`lemmy.hacktivism.ch`** |
+| **9027** | podman **`koopa-decidim`** → Caddy **`decidim.hacktivism.ch`** |
 | **9200** | podman **Forgejo git-SSH** (host-direct; not Caddy) |
 | 9090–9092 | podman `koopa-tops-ng1` … `ng3` → Caddy `tops.ng{1,2,3}.hacktivism.ch` |
 | 8080 | Tor ORPort |
 
 VeciGate: WAN **80→9000**, WAN **443→9001**.  
-Public apps: Caddy vhosts on **9001** → 127.0.0.1:{9010–9015, 9020–9026, 9090–9092}.  
+Public apps: Caddy vhosts on **9001** → 127.0.0.1:{9010–9015, 9020–9027, 9090–9092}.  
 Git SSH needs separate NAT/firewall **9200/tcp** if exposed to WAN.
 
 | **1789** | podman **`koopa-nym`** mixnet (nym.com nym-node) |