decidim: mirror koopa-decidim setup (9027, docs for /sm showcase)

2026-08-24 08:47:22 +02:00 · 2026-08-24 08:47:22 +02:00 · 9ae0dfa429
commit 9ae0dfa429
parent d519fb3c80
21 changed files with 998 additions and 2 deletions
--- a/configs/README.md
+++ b/configs/README.md
@ -9,7 +9,7 @@ Directories are named to match **live podman container names** where possible.
 | `taler-exchange/` | conf inside exchange container | (see exchange-ansible) |
 | `taler-exchange-ansible/` | **`taler-hacktivism-exchange-ansible`** | `taler-hacktivism-exchange-ansible:landing` |
 | `bank-landing/` `exchange-landing/` `merchant-landing/` | nginx landing snippets | ports 9013–9015 |
-| `koopa-*` apps | `koopa-castopod`, `koopa-bonfire`, `koopa-lemmy`, … | compose mirrors |
+| `koopa-*` apps | `koopa-castopod`, `koopa-bonfire`, `koopa-lemmy`, `koopa-decidim`, … | compose mirrors |
 | `tops/` | `koopa-tops-ng1` … `ng3` | `nginxinc/nginx-unprivileged:1.27-alpine` (non-root, :8080) |
 | `caddy/` `firewalld/` `systemd/` | host services | |
 | `tor/` | **`koopa-tor-relay`** (podman host net) | `localhost/koopa-tor-relay:latest` (**non-root** uid 1000) |
--- a/configs/caddy/decidim.hacktivism.ch.caddy
+++ b/configs/caddy/decidim.hacktivism.ch.caddy
@ -0,0 +1,17 @@
+# 9027 decidim (rails)
+# Live: merged into /etc/caddy/Caddyfile
+decidim.hacktivism.ch {
+	header Alt-Svc "clear"
+	reverse_proxy 127.0.0.1:9027 {
+		header_up Host {host}
+		header_up X-Forwarded-For {remote_host}
+		header_up X-Forwarded-Host {host}
+		header_up X-Forwarded-Proto {scheme}
+		header_up X-Forwarded-Port 443
+		flush_interval -1
+		transport http {
+			read_timeout 3600s
+			write_timeout 3600s
+		}
+	}
+}
--- a/configs/decidim/.env.example
+++ b/configs/decidim/.env.example
@ -0,0 +1,13 @@
+POSTGRES_PASSWORD=@inline-secret@
+SECRET_KEY_BASE=@inline-secret@
+DECIDIM_APPLICATION_NAME=hacktivism
+DECIDIM_MAILER_SENDER=noreply@hacktivism.ch
+DECIDIM_AVAILABLE_LOCALES=en,de,fr
+DECIDIM_DEFAULT_LOCALE=en
+DECIDIM_HOST=decidim.hacktivism.ch
+SMTP_ADDRESS=127.0.0.1
+SMTP_DOMAIN=hacktivism.ch
+SMTP_USERNAME=unused
+SMTP_PASSWORD=unused
+SMTP_PORT=25
+QUEUE_ADAPTER=sidekiq
--- a/configs/decidim/README.md
+++ b/configs/decidim/README.md
@ -0,0 +1,23 @@
+# Decidim — decidim.hacktivism.ch
+
+| Item | Value |
+|------|--------|
+| Live | `/home/hernani/koopa-decidim/` |
+| Compose | `compose.yml` (mirror, no secrets) |
+| Port | **9027** → Caddy |
+| Site | https://decidim.hacktivism.ch/ |
+| Image | `decidim/decidim:0.30.8` + postgres 16 + redis 7 + sidekiq |
+
+Secrets: host `~/koopa-decidim/{.env,users.env}` (mode 600). Not in this repo.
+
+Theme: `theme/hacktivism.css` + `theme/hacktivism.rb` (same exchange-dark palette as Bonfire/Castopod). Analog stack: `configs/castopod/`.
+
+```bash
+cd ~/koopa-decidim && set -a && source .env && set +a && podman-compose up -d
+~/koopa-decidim/bin/install-systemd.sh
+~/koopa-decidim/bin/apply-branding.sh
+```
+
+Caddy: `sudo /home/hernani/koopa-caddy/apply.sh` (vhost `decidim.hacktivism.ch` → `127.0.0.1:9027`).
+
+This tree documents **this** instance only. Secrets stay in `koopa-admin-secrets` / host `~/koopa-decidim/{.env,users.env}`.
--- a/configs/decidim/assets/img/favicon.svg
+++ b/configs/decidim/assets/img/favicon.svg
@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" width="128" height="128" role="img" aria-label="Wizard flying on magic wand, blue robe">
+  <!-- Original Kamek-inspired mark; not Nintendo art. No filters/transforms for clean raster. -->
+
+  <!-- motion streaks -->
+  <line x1="4" y1="64" x2="22" y2="64" stroke="#5eead4" stroke-width="2.5" stroke-linecap="round" opacity="0.55"/>
+  <line x1="6" y1="74" x2="20" y2="74" stroke="#38bdf8" stroke-width="2" stroke-linecap="round" opacity="0.45"/>
+  <line x1="8" y1="54" x2="20" y2="54" stroke="#fde68a" stroke-width="2" stroke-linecap="round" opacity="0.45"/>
+
+  <!-- ground shadow -->
+  <ellipse cx="64" cy="118" rx="30" ry="5" fill="#000" opacity="0.2"/>
+
+  <!-- ===== MAGIC WAND (mount) — diagonal, thick gold shaft ===== -->
+  <!-- sits under the rider from lower-left to upper-right -->
+  <line x1="6" y1="100" x2="108" y2="72" stroke="#92400e" stroke-width="11" stroke-linecap="round"/>
+  <line x1="6" y1="100" x2="108" y2="72" stroke="#e8a838" stroke-width="7" stroke-linecap="round"/>
+  <line x1="6" y1="100" x2="108" y2="72" stroke="#fde68a" stroke-width="2" stroke-linecap="round" opacity="0.75"/>
+
+  <!-- wand jewel (front tip) -->
+  <circle cx="112" cy="70" r="13" fill="#f59e0b" stroke="#fff7ed" stroke-width="3"/>
+  <circle cx="108" cy="66" r="4.5" fill="#fef9c3"/>
+  <!-- sparkles at tip -->
+  <polygon points="120,54 121.6,58.5 126,60 121.6,61.5 120,66 118.4,61.5 114,60 118.4,58.5" fill="#fef08a"/>
+  <polygon points="102,56 103,59 106,60 103,61 102,64 101,61 98,60 101,59" fill="#5eead4"/>
+  <circle cx="118" cy="78" r="2" fill="#bae6fd"/>
+
+  <!-- ===== RIDER on top of wand ===== -->
+  <!-- blue cape fluttering left -->
+  <path d="M38 78 C18 82, 10 98, 8 110 C22 98, 34 96, 40 92 Z" fill="#1e3a8a"/>
+  <path d="M40 80 C22 88, 14 104, 12 112 C28 100, 36 98, 42 94 Z" fill="#1d4ed8"/>
+
+  <!-- BLUE ROBE (body sitting ON shaft) -->
+  <ellipse cx="54" cy="86" rx="28" ry="22" fill="#1d4ed8"/>
+  <ellipse cx="54" cy="84" rx="24" ry="18" fill="#2563eb"/>
+  <!-- white trim -->
+  <path d="M32 74 Q54 94 76 74" fill="none" stroke="#f8fafc" stroke-width="4" stroke-linecap="round"/>
+  <path d="M36 82 Q54 98 72 82" fill="none" stroke="#e2e8f0" stroke-width="2.5" stroke-linecap="round"/>
+
+  <!-- green shell -->
+  <ellipse cx="66" cy="92" rx="13" ry="11" fill="#16a34a"/>
+  <ellipse cx="66" cy="92" rx="6" ry="5" fill="#86efac" opacity="0.75"/>
+
+  <!-- legs over the wand -->
+  <ellipse cx="42" cy="100" rx="10" ry="7" fill="#1e40af"/>
+  <ellipse cx="60" cy="102" rx="10" ry="7" fill="#1e40af"/>
+  <!-- yellow feet hanging past shaft -->
+  <ellipse cx="38" cy="106" rx="7" ry="4.5" fill="#fbbf24"/>
+  <ellipse cx="64" cy="108" rx="7" ry="4.5" fill="#fbbf24"/>
+
+  <!-- left arm forward -->
+  <ellipse cx="30" cy="82" rx="9" ry="7" fill="#1d4ed8"/>
+  <circle cx="24" cy="78" r="5.5" fill="#fbbf24"/>
+  <!-- right arm up -->
+  <ellipse cx="74" cy="74" rx="9" ry="7" fill="#1d4ed8"/>
+  <circle cx="80" cy="68" r="5.5" fill="#fbbf24"/>
+  <circle cx="82" cy="60" r="5" fill="#38bdf8"/>
+  <circle cx="81" cy="58" r="1.8" fill="#e0f2fe"/>
+
+  <!-- ===== HEAD ===== -->
+  <ellipse cx="54" cy="50" rx="26" ry="24" fill="#fbbf24"/>
+  <ellipse cx="54" cy="53" rx="21" ry="17" fill="#fcd34d"/>
+  <ellipse cx="34" cy="54" rx="6" ry="4" fill="#fb923c" opacity="0.4"/>
+  <ellipse cx="74" cy="54" rx="6" ry="4" fill="#fb923c" opacity="0.4"/>
+
+  <!-- glasses -->
+  <circle cx="42" cy="50" r="10" fill="#bae6fd" fill-opacity="0.4" stroke="#0f172a" stroke-width="3"/>
+  <circle cx="66" cy="50" r="10" fill="#bae6fd" fill-opacity="0.4" stroke="#0f172a" stroke-width="3"/>
+  <line x1="52" y1="50" x2="56" y2="50" stroke="#0f172a" stroke-width="3"/>
+  <line x1="32" y1="47" x2="24" y2="42" stroke="#0f172a" stroke-width="2.5" stroke-linecap="round"/>
+  <line x1="76" y1="47" x2="84" y2="42" stroke="#0f172a" stroke-width="2.5" stroke-linecap="round"/>
+  <circle cx="44" cy="50" r="3" fill="#0f172a"/>
+  <circle cx="68" cy="50" r="3" fill="#0f172a"/>
+  <circle cx="45.2" cy="48.8" r="1.1" fill="#fff"/>
+  <circle cx="69.2" cy="48.8" r="1.1" fill="#fff"/>
+
+  <!-- snout + mustache -->
+  <ellipse cx="54" cy="62" rx="8" ry="5" fill="#f59e0b"/>
+  <path d="M36 64 Q46 74 54 70 Q62 74 72 64 Q64 72 54 74 Q44 72 36 64 Z" fill="#f8fafc"/>
+  <path d="M44 66 Q54 74 64 66" fill="none" stroke="#92400e" stroke-width="2.2" stroke-linecap="round"/>
+
+  <!-- BLUE pointed hat -->
+  <path d="M28 44 L54 2 L80 44 Z" fill="#1d4ed8"/>
+  <path d="M36 44 L54 10 L72 44 Z" fill="#3b82f6" opacity="0.5"/>
+  <ellipse cx="54" cy="44" rx="30" ry="8" fill="#1e40af"/>
+  <ellipse cx="54" cy="42.5" rx="26" ry="5" fill="#2563eb"/>
+  <ellipse cx="54" cy="44" rx="30" ry="8" fill="none" stroke="#f8fafc" stroke-width="2.2"/>
+  <polygon points="54,12 55.6,16.8 60.5,18.4 55.6,20 54,24.8 52.4,20 47.5,18.4 52.4,16.8" fill="#f8fafc"/>
+  <polygon points="42,22 43.1,25.2 46.2,26.4 43.1,27.6 42,30.8 40.9,27.6 37.8,26.4 40.9,25.2" fill="#fef08a"/>
+  <circle cx="54" cy="4" r="6" fill="#f8fafc"/>
+</svg>
--- a/configs/decidim/assets/img/isoc-gold.png
+++ b/configs/decidim/assets/img/isoc-gold.png
--- a/configs/decidim/assets/img/logo.svg
+++ b/configs/decidim/assets/img/logo.svg
@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" width="128" height="128" role="img" aria-label="Wizard flying on magic wand, blue robe">
+  <!-- Original Kamek-inspired mark; not Nintendo art. No filters/transforms for clean raster. -->
+
+  <!-- motion streaks -->
+  <line x1="4" y1="64" x2="22" y2="64" stroke="#5eead4" stroke-width="2.5" stroke-linecap="round" opacity="0.55"/>
+  <line x1="6" y1="74" x2="20" y2="74" stroke="#38bdf8" stroke-width="2" stroke-linecap="round" opacity="0.45"/>
+  <line x1="8" y1="54" x2="20" y2="54" stroke="#fde68a" stroke-width="2" stroke-linecap="round" opacity="0.45"/>
+
+  <!-- ground shadow -->
+  <ellipse cx="64" cy="118" rx="30" ry="5" fill="#000" opacity="0.2"/>
+
+  <!-- ===== MAGIC WAND (mount) — diagonal, thick gold shaft ===== -->
+  <!-- sits under the rider from lower-left to upper-right -->
+  <line x1="6" y1="100" x2="108" y2="72" stroke="#92400e" stroke-width="11" stroke-linecap="round"/>
+  <line x1="6" y1="100" x2="108" y2="72" stroke="#e8a838" stroke-width="7" stroke-linecap="round"/>
+  <line x1="6" y1="100" x2="108" y2="72" stroke="#fde68a" stroke-width="2" stroke-linecap="round" opacity="0.75"/>
+
+  <!-- wand jewel (front tip) -->
+  <circle cx="112" cy="70" r="13" fill="#f59e0b" stroke="#fff7ed" stroke-width="3"/>
+  <circle cx="108" cy="66" r="4.5" fill="#fef9c3"/>
+  <!-- sparkles at tip -->
+  <polygon points="120,54 121.6,58.5 126,60 121.6,61.5 120,66 118.4,61.5 114,60 118.4,58.5" fill="#fef08a"/>
+  <polygon points="102,56 103,59 106,60 103,61 102,64 101,61 98,60 101,59" fill="#5eead4"/>
+  <circle cx="118" cy="78" r="2" fill="#bae6fd"/>
+
+  <!-- ===== RIDER on top of wand ===== -->
+  <!-- blue cape fluttering left -->
+  <path d="M38 78 C18 82, 10 98, 8 110 C22 98, 34 96, 40 92 Z" fill="#1e3a8a"/>
+  <path d="M40 80 C22 88, 14 104, 12 112 C28 100, 36 98, 42 94 Z" fill="#1d4ed8"/>
+
+  <!-- BLUE ROBE (body sitting ON shaft) -->
+  <ellipse cx="54" cy="86" rx="28" ry="22" fill="#1d4ed8"/>
+  <ellipse cx="54" cy="84" rx="24" ry="18" fill="#2563eb"/>
+  <!-- white trim -->
+  <path d="M32 74 Q54 94 76 74" fill="none" stroke="#f8fafc" stroke-width="4" stroke-linecap="round"/>
+  <path d="M36 82 Q54 98 72 82" fill="none" stroke="#e2e8f0" stroke-width="2.5" stroke-linecap="round"/>
+
+  <!-- green shell -->
+  <ellipse cx="66" cy="92" rx="13" ry="11" fill="#16a34a"/>
+  <ellipse cx="66" cy="92" rx="6" ry="5" fill="#86efac" opacity="0.75"/>
+
+  <!-- legs over the wand -->
+  <ellipse cx="42" cy="100" rx="10" ry="7" fill="#1e40af"/>
+  <ellipse cx="60" cy="102" rx="10" ry="7" fill="#1e40af"/>
+  <!-- yellow feet hanging past shaft -->
+  <ellipse cx="38" cy="106" rx="7" ry="4.5" fill="#fbbf24"/>
+  <ellipse cx="64" cy="108" rx="7" ry="4.5" fill="#fbbf24"/>
+
+  <!-- left arm forward -->
+  <ellipse cx="30" cy="82" rx="9" ry="7" fill="#1d4ed8"/>
+  <circle cx="24" cy="78" r="5.5" fill="#fbbf24"/>
+  <!-- right arm up -->
+  <ellipse cx="74" cy="74" rx="9" ry="7" fill="#1d4ed8"/>
+  <circle cx="80" cy="68" r="5.5" fill="#fbbf24"/>
+  <circle cx="82" cy="60" r="5" fill="#38bdf8"/>
+  <circle cx="81" cy="58" r="1.8" fill="#e0f2fe"/>
+
+  <!-- ===== HEAD ===== -->
+  <ellipse cx="54" cy="50" rx="26" ry="24" fill="#fbbf24"/>
+  <ellipse cx="54" cy="53" rx="21" ry="17" fill="#fcd34d"/>
+  <ellipse cx="34" cy="54" rx="6" ry="4" fill="#fb923c" opacity="0.4"/>
+  <ellipse cx="74" cy="54" rx="6" ry="4" fill="#fb923c" opacity="0.4"/>
+
+  <!-- glasses -->
+  <circle cx="42" cy="50" r="10" fill="#bae6fd" fill-opacity="0.4" stroke="#0f172a" stroke-width="3"/>
+  <circle cx="66" cy="50" r="10" fill="#bae6fd" fill-opacity="0.4" stroke="#0f172a" stroke-width="3"/>
+  <line x1="52" y1="50" x2="56" y2="50" stroke="#0f172a" stroke-width="3"/>
+  <line x1="32" y1="47" x2="24" y2="42" stroke="#0f172a" stroke-width="2.5" stroke-linecap="round"/>
+  <line x1="76" y1="47" x2="84" y2="42" stroke="#0f172a" stroke-width="2.5" stroke-linecap="round"/>
+  <circle cx="44" cy="50" r="3" fill="#0f172a"/>
+  <circle cx="68" cy="50" r="3" fill="#0f172a"/>
+  <circle cx="45.2" cy="48.8" r="1.1" fill="#fff"/>
+  <circle cx="69.2" cy="48.8" r="1.1" fill="#fff"/>
+
+  <!-- snout + mustache -->
+  <ellipse cx="54" cy="62" rx="8" ry="5" fill="#f59e0b"/>
+  <path d="M36 64 Q46 74 54 70 Q62 74 72 64 Q64 72 54 74 Q44 72 36 64 Z" fill="#f8fafc"/>
+  <path d="M44 66 Q54 74 64 66" fill="none" stroke="#92400e" stroke-width="2.2" stroke-linecap="round"/>
+
+  <!-- BLUE pointed hat -->
+  <path d="M28 44 L54 2 L80 44 Z" fill="#1d4ed8"/>
+  <path d="M36 44 L54 10 L72 44 Z" fill="#3b82f6" opacity="0.5"/>
+  <ellipse cx="54" cy="44" rx="30" ry="8" fill="#1e40af"/>
+  <ellipse cx="54" cy="42.5" rx="26" ry="5" fill="#2563eb"/>
+  <ellipse cx="54" cy="44" rx="30" ry="8" fill="none" stroke="#f8fafc" stroke-width="2.2"/>
+  <polygon points="54,12 55.6,16.8 60.5,18.4 55.6,20 54,24.8 52.4,20 47.5,18.4 52.4,16.8" fill="#f8fafc"/>
+  <polygon points="42,22 43.1,25.2 46.2,26.4 43.1,27.6 42,30.8 40.9,27.6 37.8,26.4 40.9,25.2" fill="#fef08a"/>
+  <circle cx="54" cy="4" r="6" fill="#f8fafc"/>
+</svg>
--- a/configs/decidim/bin/apply-branding.sh
+++ b/configs/decidim/bin/apply-branding.sh
@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Apply hacktivism colors + header CSS on the live organization.
+set -euo pipefail
+cd "${HOME}/koopa-decidim"
+set -a
+# shellcheck disable=SC1091
+source .env
+# shellcheck disable=SC1091
+source users.env
+set +a
+podman exec \
+  -e DECIDIM_HOST="${DECIDIM_HOST:-decidim.hacktivism.ch}" \
+  -e DECIDIM_SYSTEM_EMAIL \
+  -e DECIDIM_SYSTEM_PASSWORD \
+  -e DECIDIM_ADMIN_EMAIL \
+  -e DECIDIM_ADMIN_PASSWORD \
+  -e DECIDIM_ADMIN_NAME \
+  -e DECIDIM_APPLICATION_NAME \
+  -e DECIDIM_DEFAULT_LOCALE \
+  -e DECIDIM_AVAILABLE_LOCALES \
+  koopa-decidim bundle exec rails runner /code/lib/koopa_bootstrap.rb
+echo "branding applied. public: https://decidim.hacktivism.ch/"
--- a/configs/decidim/bin/install-systemd.sh
+++ b/configs/decidim/bin/install-systemd.sh
@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Install Decidim user systemd units on koopa (boot via linger).
+set -euo pipefail
+HERE="$(cd "$(dirname "$0")" && pwd)"
+LIVE="${HOME}/koopa-decidim"
+# admin-log tree (scripts/decidim → ../..) or live ~/koopa-decidim/bin
+if [ -f "${HERE}/../../configs/decidim/container-koopa-decidim.service" ]; then
+  UNIT_SRC="${HERE}/../../configs/decidim"
+elif [ -f "${LIVE}/container-koopa-decidim.service" ]; then
+  UNIT_SRC="${LIVE}"
+else
+  echo "ERROR: decidim unit files not found" >&2
+  exit 1
+fi
+UNIT_DIR="${HOME}/.config/systemd/user"
+
+mkdir -p "${UNIT_DIR}"
+cp "${UNIT_SRC}/container-koopa-decidim-db.service" "${UNIT_DIR}/"
+cp "${UNIT_SRC}/container-koopa-decidim.service" "${UNIT_DIR}/"
+
+systemctl --user daemon-reload
+systemctl --user enable \
+  container-koopa-decidim-db.service \
+  container-koopa-decidim.service
+
+if ! podman ps --format '{{.Names}}' | grep -qx koopa-decidim; then
+  (cd "${HOME}/koopa-decidim" && set -a && source .env && set +a && podman-compose up -d)
+fi
+
+systemctl --user start \
+  container-koopa-decidim-db.service \
+  container-koopa-decidim.service
+
+systemctl --user --no-pager --lines=0 status \
+  container-koopa-decidim-db.service \
+  container-koopa-decidim.service || true
+
+echo "OK. Public: https://decidim.hacktivism.ch/"
--- a/configs/decidim/bin/seed-example.sh
+++ b/configs/decidim/bin/seed-example.sh
@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Publish public example process/meeting + optional isoc user from users.env.
+set -euo pipefail
+cd "${HOME}/koopa-decidim"
+set -a
+# shellcheck disable=SC1091
+source .env
+# shellcheck disable=SC1091
+source users.env
+set +a
+
+src=""
+if [ -f "${HOME}/src/koopa/koopa-admin-log/configs/decidim/seed_example.rb" ]; then
+  src="${HOME}/src/koopa/koopa-admin-log/configs/decidim/seed_example.rb"
+elif [ -f ./seed_example.rb ]; then
+  src="./seed_example.rb"
+else
+  echo "ERROR: seed_example.rb not found" >&2
+  exit 1
+fi
+podman cp "${src}" koopa-decidim:/code/lib/koopa_seed_example.rb
+
+avatar_host="${DECIDIM_ISOC_AVATAR:-${HOME}/koopa-decidim/assets/img/isoc-gold.png}"
+avatar_ctr=""
+if [ -f "${avatar_host}" ]; then
+  avatar_ctr="/tmp/isoc-gold.png"
+  podman cp "${avatar_host}" "koopa-decidim:${avatar_ctr}"
+fi
+
+podman exec \
+  -e DECIDIM_HOST="${DECIDIM_HOST:-decidim.hacktivism.ch}" \
+  -e DECIDIM_ADMIN_EMAIL \
+  -e DECIDIM_ISOC_EMAIL \
+  -e DECIDIM_ISOC_PASSWORD \
+  -e DECIDIM_ISOC_NAME \
+  -e DECIDIM_ISOC_NICKNAME \
+  -e DECIDIM_ISOC_AVATAR="${avatar_ctr}" \
+  koopa-decidim bundle exec rails runner /code/lib/koopa_seed_example.rb
+echo "seed done. public: https://decidim.hacktivism.ch/processes/example"
--- a/configs/decidim/bin/up.sh
+++ b/configs/decidim/bin/up.sh
@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+set -euo pipefail
+DIR="${HOME}/koopa-decidim"
+cd "${DIR}"
+set -a
+# shellcheck disable=SC1091
+source .env
+set +a
+podman-compose up -d
+echo "== wait for :9027 =="
+ok=0
+for i in $(seq 1 80); do
+  code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 5 "http://127.0.0.1:9027/" || true)
+  echo "try $i: $code"
+  case "$code" in
+    2*|3*) ok=1; break ;;
+  esac
+  sleep 5
+done
+[[ "$ok" -eq 1 ]] || { echo "ERROR: no answer on 9027"; podman-compose ps; exit 1; }
+echo "local ok. public: https://decidim.hacktivism.ch/"
--- a/configs/decidim/bootstrap.rb
+++ b/configs/decidim/bootstrap.rb
@ -0,0 +1,78 @@
+# frozen_string_literal: true
+# Create system admin + organization + org admin. Idempotent.
+# Usage: bundle exec rails runner /code/lib/koopa_bootstrap.rb
+
+host = ENV.fetch("DECIDIM_HOST", "decidim.hacktivism.ch")
+sys_email = ENV.fetch("DECIDIM_SYSTEM_EMAIL")
+sys_password = ENV.fetch("DECIDIM_SYSTEM_PASSWORD")
+admin_email = ENV.fetch("DECIDIM_ADMIN_EMAIL")
+admin_password = ENV.fetch("DECIDIM_ADMIN_PASSWORD")
+admin_name = ENV.fetch("DECIDIM_ADMIN_NAME", "hacktivism")
+org_name = ENV.fetch("DECIDIM_APPLICATION_NAME", "hacktivism")
+
+sys = Decidim::System::Admin.find_or_initialize_by(email: sys_email)
+sys.password = sys_password
+sys.password_confirmation = sys_password
+sys.save!
+puts "system admin: #{sys.email}"
+
+org = Decidim::Organization.find_by(host: host)
+if org.nil?
+  attrs = {
+    host: host,
+    default_locale: ENV.fetch("DECIDIM_DEFAULT_LOCALE", "en"),
+    available_locales: ENV.fetch("DECIDIM_AVAILABLE_LOCALES", "en,de,fr").split(","),
+    reference_prefix: "HCK",
+    time_zone: "Europe/Zurich",
+    users_registration_mode: "enabled",
+    force_users_to_authenticate_before_access_organization: false,
+    available_authorizations: [],
+    tos_version: Time.current,
+    colors: {
+      "primary" => "#e8a838",
+      "secondary" => "#3ecfbf",
+      "tertiary" => "#3d3128",
+      "success" => "#16a34a",
+      "warning" => "#f0d090",
+      "alert" => "#e7131a"
+    },
+    header_snippets: %(<link rel="stylesheet" href="/hacktivism.css"><script src="/hacktivism-consent.js"></script><link rel="icon" href="/hacktivism-favicon.svg">)
+  }
+  name_val = { "en" => org_name, "de" => org_name, "fr" => org_name }
+  desc_val = { "en" => "hacktivism participatory platform", "de" => "hacktivism Partizipationsplattform", "fr" => "plateforme participative hacktivism" }
+  begin
+    org = Decidim::Organization.new(attrs.merge(name: name_val, description: desc_val))
+    org.save!
+  rescue StandardError
+    org = Decidim::Organization.new(attrs.merge(name: org_name, description: "hacktivism participatory platform"))
+    org.save!
+  end
+  Decidim::System::CreateDefaultPages.call(org) if defined?(Decidim::System::CreateDefaultPages)
+  Decidim::System::CreateDefaultContentBlocks.call(org) if defined?(Decidim::System::CreateDefaultContentBlocks)
+  puts "organization created host=#{org.host}"
+else
+  org.colors = {
+    "primary" => "#e8a838",
+    "secondary" => "#3ecfbf",
+    "tertiary" => "#3d3128",
+    "success" => "#16a34a",
+    "warning" => "#f0d090",
+    "alert" => "#e7131a"
+  }
+  org.header_snippets = %(<link rel="stylesheet" href="/hacktivism.css"><script src="/hacktivism-consent.js"></script><link rel="icon" href="/hacktivism-favicon.svg">)
+  org.save!
+  puts "organization updated host=#{org.host}"
+end
+
+user = Decidim::User.find_or_initialize_by(email: admin_email, organization: org)
+user.name = admin_name
+user.nickname = admin_name.downcase.gsub(/[^a-z0-9_]/, "")[0, 20]
+user.password = admin_password
+user.password_confirmation = admin_password
+user.admin = true
+user.confirmed_at ||= Time.current
+user.tos_agreement = true
+user.accepted_tos_version = org.tos_version
+user.locale = org.default_locale
+user.save!
+puts "org admin: #{user.email}"
--- a/configs/decidim/compose.yml
+++ b/configs/decidim/compose.yml
@ -0,0 +1,131 @@
+# koopa-decidim — Decidim behind host Caddy on :9027
+# Docs: https://docs.decidim.org/en/develop/install/
+# Image: official pre-generated app (core modules only). No secrets in this file.
+
+x-logging: &default-logging
+  driver: "json-file"
+  options:
+    max-size: "50m"
+    max-file: "4"
+
+x-app-env: &app-env
+  RAILS_ENV: production
+  RAILS_SERVE_STATIC_FILES: "true"
+  RAILS_LOG_TO_STDOUT: "true"
+  DATABASE_URL: postgres://decidim:${POSTGRES_PASSWORD}@postgres:5432/decidim
+  REDIS_URL: redis://redis:6379/0
+  SECRET_KEY_BASE: ${SECRET_KEY_BASE}
+  DECIDIM_APPLICATION_NAME: ${DECIDIM_APPLICATION_NAME:-hacktivism}
+  DECIDIM_MAILER_SENDER: ${DECIDIM_MAILER_SENDER:-noreply@hacktivism.ch}
+  DECIDIM_AVAILABLE_LOCALES: ${DECIDIM_AVAILABLE_LOCALES:-en,de,fr}
+  DECIDIM_DEFAULT_LOCALE: ${DECIDIM_DEFAULT_LOCALE:-en}
+  SMTP_ADDRESS: ${SMTP_ADDRESS:-127.0.0.1}
+  SMTP_DOMAIN: ${SMTP_DOMAIN:-hacktivism.ch}
+  SMTP_USERNAME: ${SMTP_USERNAME:-unused}
+  SMTP_PASSWORD: ${SMTP_PASSWORD:-unused}
+  SMTP_PORT: ${SMTP_PORT:-25}
+  SMTP_AUTHENTICATION: ${SMTP_AUTHENTICATION:-plain}
+  QUEUE_ADAPTER: ${QUEUE_ADAPTER:-sidekiq}
+
+services:
+  decidim:
+    image: docker.io/decidim/decidim:0.30.8
+    container_name: koopa-decidim
+    hostname: decidim
+    ports:
+      - "9027:3000"
+    env_file:
+      - .env
+    environment:
+      <<: *app-env
+    volumes:
+      - ./entrypoint.sh:/usr/local/bin/koopa-decidim-entrypoint.sh:ro
+      - ./theme/hacktivism.rb:/code/config/initializers/hacktivism.rb:ro
+      - ./theme/hacktivism.css:/code/public/hacktivism.css:ro
+      - ./bootstrap.rb:/code/lib/koopa_bootstrap.rb:ro
+      - ./assets/img/logo.svg:/code/public/hacktivism-logo.svg:ro
+      - ./assets/img/favicon.svg:/code/public/hacktivism-favicon.svg:ro
+      - decidim-storage:/code/storage
+      - decidim-uploads:/code/public/uploads
+      - decidim-tmp:/code/tmp
+    entrypoint: ["/bin/bash", "/usr/local/bin/koopa-decidim-entrypoint.sh"]
+    command: ["bundle", "exec", "rails", "s", "-b", "0.0.0.0", "-p", "3000"]
+    restart: unless-stopped
+    logging: *default-logging
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    labels:
+      org.hacktivism.service: decidim
+      org.hacktivism.host_port: "9027"
+      org.hacktivism.site: decidim.hacktivism.ch
+      org.hacktivism.managed_by: koopa-admin
+
+  sidekiq:
+    image: docker.io/decidim/decidim:0.30.8
+    container_name: koopa-decidim-sidekiq
+    hostname: sidekiq
+    env_file:
+      - .env
+    environment:
+      <<: *app-env
+    volumes:
+      - ./entrypoint.sh:/usr/local/bin/koopa-decidim-entrypoint.sh:ro
+      - ./theme/hacktivism.rb:/code/config/initializers/hacktivism.rb:ro
+      - decidim-storage:/code/storage
+      - decidim-uploads:/code/public/uploads
+      - decidim-tmp:/code/tmp
+    entrypoint: ["/bin/bash", "/usr/local/bin/koopa-decidim-entrypoint.sh"]
+    command: ["bundle", "exec", "sidekiq", "-C", "config/sidekiq.yml"]
+    restart: unless-stopped
+    logging: *default-logging
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    labels:
+      org.hacktivism.service: decidim
+      org.hacktivism.managed_by: koopa-admin
+
+  postgres:
+    image: docker.io/library/postgres:16-alpine
+    container_name: koopa-decidim-db
+    hostname: postgres
+    environment:
+      - POSTGRES_USER=decidim
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DB=decidim
+    volumes:
+      - decidim-db:/var/lib/postgresql/data
+    restart: unless-stopped
+    logging: *default-logging
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U decidim -d decidim"]
+      interval: 5s
+      timeout: 5s
+      retries: 12
+    labels:
+      org.hacktivism.service: decidim
+      org.hacktivism.managed_by: koopa-admin
+
+  redis:
+    image: docker.io/library/redis:7-alpine
+    container_name: koopa-decidim-redis
+    hostname: redis
+    volumes:
+      - decidim-redis:/data
+    restart: unless-stopped
+    logging: *default-logging
+    labels:
+      org.hacktivism.service: decidim
+      org.hacktivism.managed_by: koopa-admin
+
+volumes:
+  decidim-db:
+  decidim-redis:
+  decidim-storage:
+  decidim-uploads:
+  decidim-tmp:
--- a/configs/decidim/container-koopa-decidim-db.service
+++ b/configs/decidim/container-koopa-decidim-db.service
@ -0,0 +1,21 @@
+# user systemd — Decidim postgres + redis
+[Unit]
+Description=Decidim postgres/redis (koopa-decidim-db)
+Wants=network-online.target
+After=network-online.target
+RequiresMountsFor=%t/containers
+
+[Service]
+Environment=PODMAN_SYSTEMD_UNIT=%n
+Restart=on-failure
+RestartSec=20
+TimeoutStartSec=300
+TimeoutStopSec=120
+WorkingDirectory=/home/hernani/koopa-decidim
+ExecStart=/bin/bash -lc 'set -a && source .env && set +a && /usr/bin/podman-compose up -d postgres redis'
+ExecStop=/usr/bin/podman stop -t 30 koopa-decidim-db koopa-decidim-redis
+Type=oneshot
+RemainAfterExit=yes
+
+[Install]
+WantedBy=default.target
--- a/configs/decidim/container-koopa-decidim.service
+++ b/configs/decidim/container-koopa-decidim.service
@ -0,0 +1,21 @@
+# user systemd — Decidim stack (app + sidekiq)
+[Unit]
+Description=Decidim stack (koopa-decidim)
+Wants=network-online.target container-koopa-decidim-db.service
+After=network-online.target container-koopa-decidim-db.service
+RequiresMountsFor=%t/containers
+
+[Service]
+Environment=PODMAN_SYSTEMD_UNIT=%n
+Restart=on-failure
+RestartSec=20
+TimeoutStartSec=600
+TimeoutStopSec=120
+WorkingDirectory=/home/hernani/koopa-decidim
+ExecStart=/bin/bash -lc 'set -a && source .env && set +a && /usr/bin/podman-compose up -d'
+ExecStop=/usr/bin/podman stop -t 30 koopa-decidim koopa-decidim-sidekiq
+Type=oneshot
+RemainAfterExit=yes
+
+[Install]
+WantedBy=default.target
--- a/configs/decidim/entrypoint.sh
+++ b/configs/decidim/entrypoint.sh
@ -0,0 +1,22 @@
+#!/bin/bash
+# Wait for Postgres, migrate, then exec CMD (rails or sidekiq).
+set -euo pipefail
+
+export RAILS_ENV="${RAILS_ENV:-production}"
+
+echo "koopa-decidim: waiting for postgres..."
+i=0
+until bundle exec rails runner 'ActiveRecord::Base.connection.execute("SELECT 1")' >/dev/null 2>&1; do
+  i=$((i + 1))
+  if [ "$i" -ge 60 ]; then
+    echo "koopa-decidim: postgres not ready after ${i} tries" >&2
+    exit 1
+  fi
+  sleep 3
+done
+
+echo "koopa-decidim: db:prepare"
+bundle exec rails db:prepare
+
+echo "koopa-decidim: exec $*"
+exec "$@"
--- a/configs/decidim/seed_example.rb
+++ b/configs/decidim/seed_example.rb
@ -0,0 +1,247 @@
+# frozen_string_literal: true
+# Public process + meeting + page + proposal (readable without an account).
+# Optional participant from env: DECIDIM_ISOC_EMAIL / DECIDIM_ISOC_PASSWORD.
+# Optional avatar: DECIDIM_ISOC_AVATAR (PNG path inside the container).
+# Usage: bundle exec rails runner /code/lib/koopa_seed_example.rb
+
+def t(en, de, fr)
+  { "en" => en, "de" => de, "fr" => fr }
+end
+
+def fail_model!(record)
+  raise "#{record.class}: #{record.errors.full_messages.join("; ")}"
+end
+
+host = ENV.fetch("DECIDIM_HOST", "decidim.hacktivism.ch")
+org = Decidim::Organization.find_by!(host: host)
+admin = Decidim::User.find_by!(email: ENV.fetch("DECIDIM_ADMIN_EMAIL"), organization: org)
+
+org.update!(force_users_to_authenticate_before_access_organization: false)
+
+slug = "example"
+process = Decidim::ParticipatoryProcess.find_or_initialize_by(organization: org, slug: slug)
+process.assign_attributes(
+  title: t(
+    "Public digital commons",
+    "Öffentliche digitale Allmende",
+    "Communs numériques publics"
+  ),
+  subtitle: t(
+    "Which self-hosted services stay readable without an account?",
+    "Welche selbst gehosteten Dienste bleiben ohne Konto lesbar?",
+    "Quels services auto-hébergés restent lisibles sans compte ?"
+  ),
+  short_description: t(
+    "<p>hacktivism.ch already runs Lemmy, Bonfire, Castopod and Decidim. This process asks what must stay readable without a login — and what may require an account to write.</p>",
+    "<p>hacktivism.ch betreibt bereits Lemmy, Bonfire, Castopod und Decidim. Dieser Prozess fragt, was ohne Anmeldung lesbar bleiben muss — und wofür ein Konto zum Schreiben reicht.</p>",
+    "<p>hacktivism.ch fait déjà tourner Lemmy, Bonfire, Castopod et Decidim. Ce processus demande ce qui doit rester lisible sans compte — et ce qui peut exiger un compte pour écrire.</p>"
+  ),
+  description: t(
+    "<p>Reading civic material should not depend on creating an account. Writing (proposals, comments, votes) can.</p>" \
+    "<p>Concrete questions:</p><ul>" \
+    "<li>Process pages, meetings and last activities stay public.</li>" \
+    "<li>No third-party trackers; cookies only what the software needs.</li>" \
+    "<li>Which other stacks on hacktivism.ch (Lemmy feeds, Castopod episodes, Bonfire public posts) follow the same rule.</li>" \
+    "</ul><p>Anyone can read this process. Sign in only to take part.</p>",
+    "<p>Öffentliches Beteiligungsmaterial soll ohne Konto lesbar sein. Schreiben (Vorschläge, Kommentare, Stimmen) kann ein Konto brauchen.</p>" \
+    "<p>Konkrete Fragen:</p><ul>" \
+    "<li>Prozessseiten, Treffen und letzte Aktivitäten bleiben öffentlich.</li>" \
+    "<li>Keine Drittanbieter-Tracker; Cookies nur, was die Software braucht.</li>" \
+    "<li>Welche anderen Dienste auf hacktivism.ch (Lemmy, Castopod, Bonfire) derselben Regel folgen.</li>" \
+    "</ul><p>Lesen ohne Anmeldung. Anmelden nur zum Mitmachen.</p>",
+    "<p>Lire du matériel civique ne doit pas exiger un compte. Écrire (propositions, commentaires, votes) peut le faire.</p>" \
+    "<p>Questions concrètes :</p><ul>" \
+    "<li>Pages de processus, rencontres et dernières activités restent publiques.</li>" \
+    "<li>Pas de traqueurs tiers ; cookies uniquement pour le logiciel.</li>" \
+    "<li>Quels autres services sur hacktivism.ch (Lemmy, Castopod, Bonfire) suivent la même règle.</li>" \
+    "</ul><p>Lecture sans compte. Connexion seulement pour participer.</p>"
+  ),
+  start_date: Date.current,
+  end_date: Date.current + 180,
+  published_at: process.published_at || Time.current,
+  private_space: false,
+  promoted: true,
+  scopes_enabled: false,
+  weight: 1
+)
+process.save || fail_model!(process)
+puts "process id=#{process.id} slug=#{process.slug} published=#{process.published_at}"
+
+step = process.steps.find_or_initialize_by(position: 1)
+step.assign_attributes(
+  title: t("Open discussion", "Offene Diskussion", "Discussion ouverte"),
+  description: t(
+    "<p>Collect positions on public-by-default reading. No decision this step.</p>",
+    "<p>Positionen zum Lesen ohne Konto sammeln. In dieser Phase keine Entscheidung.</p>",
+    "<p>Recueillir les positions sur la lecture sans compte. Pas de décision à cette étape.</p>"
+  ),
+  start_date: Date.current,
+  end_date: Date.current + 180,
+  active: true
+)
+step.save || fail_model!(step)
+puts "step id=#{step.id} active=#{step.active}"
+
+pages = Decidim::Component.find_or_initialize_by(
+  participatory_space: process,
+  manifest_name: "pages"
+)
+pages.assign_attributes(
+  name: t("Background", "Hintergrund", "Contexte"),
+  published_at: pages.published_at || Time.current,
+  visible: true,
+  weight: 0
+)
+pages.save || fail_model!(pages)
+page = Decidim::Pages::Page.find_or_initialize_by(component: pages)
+page.body = t(
+  "<p>ISOC-style public-interest internet: people should inspect how a civic tool works without first handing over an identity.</p>" \
+  "<p>On this instance the stock cookie banner is hidden; only essential consent is set. The same idea applies to participation spaces: the text of a process is not a privilege of registered users.</p>" \
+  "<p>This page is part of that argument. It is published on purpose.</p>",
+  "<p>Internet im öffentlichen Interesse: man soll sehen können, wie ein Beteiligungswerkzeug arbeitet, ohne zuerst eine Identität abzugeben.</p>" \
+  "<p>Auf dieser Instanz ist der Vorrats-Cookie-Banner ausgeblendet; es gilt nur essential. Dieselbe Idee gilt für Beteiligungsräume: der Text eines Prozesses ist kein Privileg registrierter Konten.</p>" \
+  "<p>Diese Seite ist absichtlich öffentlich.</p>",
+  "<p>Internet d'intérêt public : on doit pouvoir voir comment un outil civique fonctionne sans d'abord céder une identité.</p>" \
+  "<p>Ici, la bannière cookies par défaut est masquée ; seul l'essentiel est posé. Même idée pour les espaces de participation : le texte d'un processus n'est pas un privilège des comptes.</p>" \
+  "<p>Cette page est publique volontairement.</p>"
+)
+page.save || fail_model!(page)
+puts "pages component id=#{pages.id} page=#{page.id}"
+
+meetings = Decidim::Component.find_or_initialize_by(
+  participatory_space: process,
+  manifest_name: "meetings"
+)
+meetings.assign_attributes(
+  name: t("Meetings", "Treffen", "Rencontres"),
+  published_at: meetings.published_at || Time.current,
+  visible: true,
+  weight: 1
+)
+meetings.save || fail_model!(meetings)
+puts "meetings component id=#{meetings.id} published=#{meetings.published_at}"
+
+start_at = Time.current.utc.change(hour: 18, min: 0) + 7.days
+finish_at = start_at + 2.hours
+meeting = Decidim::Meetings::Meeting.find_or_initialize_by(
+  component: meetings,
+  author: admin
+)
+meeting.title = t(
+  "Open session: reading without an account",
+  "Offene Runde: Lesen ohne Konto",
+  "Séance ouverte : lire sans compte"
+)
+meeting.assign_attributes(
+  description: t(
+    "<p>Public agenda (no registration to read):</p><ol>" \
+    "<li>What is already public on hacktivism.ch (Lemmy, Decidim, Castopod).</li>" \
+    "<li>Privacy by default — no tracker banner as a gate.</li>" \
+    "<li>Where login is justified (writing, admin).</li>" \
+    "</ol><p>Online / public. Signing in is optional.</p>",
+    "<p>Öffentliche Traktanden (Lesen ohne Anmeldung):</p><ol>" \
+    "<li>Was auf hacktivism.ch schon öffentlich ist (Lemmy, Decidim, Castopod).</li>" \
+    "<li>Privatsphäre als Vorgabe — kein Tracker-Banner als Tür.</li>" \
+    "<li>Wo ein Login gerechtfertigt ist (Schreiben, Admin).</li>" \
+    "</ol><p>Online / öffentlich. Anmelden ist freiwillig.</p>",
+    "<p>Ordre du jour public (lecture sans inscription) :</p><ol>" \
+    "<li>Ce qui est déjà public sur hacktivism.ch (Lemmy, Decidim, Castopod).</li>" \
+    "<li>Vie privée par défaut — pas de bannière traqueur comme porte.</li>" \
+    "<li>Où un compte se justifie (écriture, admin).</li>" \
+    "</ol><p>En ligne / public. Connexion facultative.</p>"
+  ),
+  start_time: meeting.start_time || start_at,
+  end_time: meeting.end_time || finish_at,
+  address: "hacktivism.ch",
+  location: t("Online, public stream notes", "Online, öffentliche Notizen", "En ligne, notes publiques"),
+  location_hints: t(
+    "No ticket. Page stays readable if you do not attend.",
+    "Kein Ticket. Die Seite bleibt lesbar, wenn man nicht teilnimmt.",
+    "Pas de billet. La page reste lisible sans y assister."
+  ),
+  type_of_meeting: "in_person",
+  registration_type: "registration_disabled",
+  registrations_enabled: false,
+  private_meeting: false,
+  transparent: true,
+  published_at: meeting.published_at || Time.current,
+  comments_enabled: true
+)
+meeting.save || fail_model!(meeting)
+puts "meeting id=#{meeting.id} published=#{meeting.published_at} start=#{meeting.start_time}"
+
+proposals = Decidim::Component.find_or_initialize_by(
+  participatory_space: process,
+  manifest_name: "proposals"
+)
+proposals.assign_attributes(
+  name: t("Proposals", "Vorschläge", "Propositions"),
+  published_at: proposals.published_at || Time.current,
+  visible: true,
+  weight: 2
+)
+proposals.save || fail_model!(proposals)
+
+proposal = Decidim::Proposals::Proposal.find_or_initialize_by(component: proposals)
+if proposal.new_record? || proposal.title.blank?
+  proposal.title = t(
+    "Keep public processes readable without login",
+    "Öffentliche Prozesse ohne Anmeldung lesbar halten",
+    "Garder les processus publics lisibles sans connexion"
+  )
+  proposal.body = t(
+    "<p>Decide as a standing rule: published process pages, meetings and this proposal list stay readable without an account. Login is only for creating or endorsing proposals, commenting, and administration.</p>",
+    "<p>Als Regel festhalten: veröffentlichte Prozessseiten, Treffen und diese Vorschlagsliste bleiben ohne Konto lesbar. Login nur zum Erstellen oder Unterstützen von Vorschlägen, Kommentieren und für die Administration.</p>",
+    "<p>En faire une règle : les pages de processus publiées, les rencontres et cette liste de propositions restent lisibles sans compte. Connexion seulement pour créer ou soutenir, commenter, et pour l'administration.</p>"
+  )
+  proposal.add_coauthor(admin)
+  proposal.published_at = Time.current
+end
+proposal.save || fail_model!(proposal)
+puts "proposal id=#{proposal.id} published=#{proposal.published_at}"
+
+block = Decidim::ContentBlock.find_or_initialize_by(
+  organization: org,
+  scope_name: "homepage",
+  manifest_name: "highlighted_processes"
+)
+block.weight ||= 45
+block.published_at ||= Time.current
+block.save || fail_model!(block)
+puts "homepage highlighted_processes published=#{block.published_at}"
+
+isoc_email = ENV["DECIDIM_ISOC_EMAIL"].to_s.strip
+isoc_password = ENV["DECIDIM_ISOC_PASSWORD"].to_s
+if isoc_email.empty? || isoc_password.empty?
+  puts "isoc user skipped (DECIDIM_ISOC_EMAIL / DECIDIM_ISOC_PASSWORD unset)"
+else
+  isoc = Decidim::User.find_or_initialize_by(email: isoc_email, organization: org)
+  isoc.name = ENV.fetch("DECIDIM_ISOC_NAME", "isoc")
+  isoc.nickname = ENV.fetch("DECIDIM_ISOC_NICKNAME", "isoc")
+  isoc.password = isoc_password
+  isoc.password_confirmation = isoc_password
+  isoc.admin = false
+  isoc.confirmed_at ||= Time.current
+  isoc.tos_agreement = true
+  isoc.accepted_tos_version = org.tos_version
+  isoc.locale = org.default_locale
+  isoc.save || fail_model!(isoc)
+  avatar_path = ENV["DECIDIM_ISOC_AVATAR"].to_s
+  if !avatar_path.empty? && File.file?(avatar_path)
+    isoc.avatar.purge if isoc.avatar.attached?
+    isoc.avatar.attach(
+      io: File.open(avatar_path, "rb"),
+      filename: "isoc-gold.png",
+      content_type: "image/png"
+    )
+    isoc.save || fail_model!(isoc)
+    puts "isoc avatar attached from #{avatar_path} blob=#{isoc.avatar.blob&.byte_size}"
+  else
+    puts "isoc avatar skipped (DECIDIM_ISOC_AVATAR missing)"
+  end
+  puts "isoc user id=#{isoc.id} email=#{isoc.email} nick=#{isoc.nickname} admin=#{isoc.admin} confirmed=#{isoc.confirmed_at}"
+end
+
+puts "public process: https://#{host}/processes/#{process.slug}"
+puts "public meeting: https://#{host}/processes/#{process.slug}/f/#{meetings.id}/meetings/#{meeting.id}"
+puts "public proposal: https://#{host}/processes/#{process.slug}/f/#{proposals.id}/proposals/#{proposal.id}"
--- a/configs/decidim/theme/hacktivism-consent.js
+++ b/configs/decidim/theme/hacktivism-consent.js
@ -0,0 +1,10 @@
+/* Essential-only consent; banner hidden via CSS. */
+(function () {
+  var name = "decidim-consent";
+  if (document.cookie.indexOf(name + "=") !== -1) return;
+  document.cookie =
+    name +
+    "=" +
+    encodeURIComponent(JSON.stringify({ essential: true })) +
+    "; path=/; max-age=31536000; SameSite=Lax";
+})();
--- a/configs/decidim/theme/hacktivism.css
+++ b/configs/decidim/theme/hacktivism.css
@ -0,0 +1,98 @@
+/* hacktivism — same palette as bonfire/git/lemmy (exchange-dark) */
+:root,
+html {
+  --primary: #e8a838;
+  --primary-rgb: 232, 168, 56;
+  --secondary: #3ecfbf;
+  --secondary-rgb: 62, 207, 191;
+  --tertiary: #3d3128;
+  --success: #16a34a;
+  --warning: #f0d090;
+  --alert: #e7131a;
+  --highlight: #e8a838;
+}
+
+html,
+body {
+  background-color: #1a1410 !important;
+  background-image:
+    radial-gradient(ellipse 90% 55% at 50% 108%, rgba(26, 107, 110, 0.35) 0%, transparent 55%),
+    radial-gradient(circle 420px at 12% 18%, rgba(232, 168, 56, 0.22) 0%, transparent 62%),
+    linear-gradient(165deg, #2c1e14 0%, #1a1410 38%, #12181a 72%, #0e1c1e 100%) !important;
+  background-attachment: fixed !important;
+  color: #fff6e8 !important;
+}
+
+a {
+  color: #e8a838 !important;
+}
+a:hover {
+  color: #f0d090 !important;
+}
+
+.title-bar,
+.main-bar,
+.navbar,
+.topbar,
+header.header,
+.main-nav,
+.footer,
+.mini-footer,
+.off-canvas,
+.sidebar {
+  background-color: #14110e !important;
+  color: #fff6e8 !important;
+  border-color: #2a2018 !important;
+}
+
+.card,
+.card__content,
+.callout,
+.flash,
+.dialog,
+.reveal,
+.accordion-item,
+.comment-thread,
+.process-header,
+.hero,
+.home-section {
+  background-color: #221c16 !important;
+  color: #fff6e8 !important;
+  border-color: #2a2018 !important;
+}
+
+.button,
+.button.primary,
+.button--sc,
+input[type="submit"].button {
+  background-color: #e8a838 !important;
+  border-color: #e8a838 !important;
+  color: #1a1410 !important;
+}
+
+.button.secondary {
+  background-color: #3d3128 !important;
+  border-color: #3d3128 !important;
+  color: #fff6e8 !important;
+}
+
+h1, h2, h3, h4, h5, h6,
+.title-bar__title,
+.card__title {
+  color: #f0c86a !important;
+}
+
+input,
+textarea,
+select,
+.input-group-field {
+  background-color: #221c16 !important;
+  color: #fff6e8 !important;
+  border-color: #3d3128 !important;
+}
+
+/* No third-party trackers; hide stock GDPR banner (privacy by default). */
+#dc-dialog-wrapper,
+.cookies__container {
+  display: none !important;
+}
--- a/configs/decidim/theme/hacktivism.rb
+++ b/configs/decidim/theme/hacktivism.rb
@ -0,0 +1,14 @@
+# frozen_string_literal: true
+# hacktivism theme + host allowlist for decidim.hacktivism.ch
+
+Rails.application.config.hosts << "decidim.hacktivism.ch"
+Rails.application.config.hosts << "127.0.0.1"
+Rails.application.config.hosts << "localhost"
+
+if Rails.application.config.respond_to?(:assume_ssl=)
+  Rails.application.config.assume_ssl = true
+end
+
+Decidim.configure do |config|
+  config.enable_html_header_snippets = true if config.respond_to?(:enable_html_header_snippets=)
+end
--- a/configs/ports.md
+++ b/configs/ports.md
@ -18,12 +18,13 @@
 | **9024** | podman **`koopa-forgejo`** (HTTP) → Caddy **`git.hacktivism.ch`** |
 | **9025** | podman **`koopa-paivana`** (paivana-httpd) → Caddy **`paivana.hacktivism.ch`** |
 | **9026** | podman **`koopa-lemmy-proxy`** → Caddy **`lemmy.hacktivism.ch`** |
+| **9027** | podman **`koopa-decidim`** → Caddy **`decidim.hacktivism.ch`** |
 | **9200** | podman **Forgejo git-SSH** (host-direct; not Caddy) |
 | 9090–9092 | podman `koopa-tops-ng1` … `ng3` → Caddy `tops.ng{1,2,3}.hacktivism.ch` |
 | 8080 | Tor ORPort |

 VeciGate: WAN **80→9000**, WAN **443→9001**.  
-Public apps: Caddy vhosts on **9001** → 127.0.0.1:{9010–9015, 9020–9026, 9090–9092}.  
+Public apps: Caddy vhosts on **9001** → 127.0.0.1:{9010–9015, 9020–9027, 9090–9092}.  
 Git SSH needs separate NAT/firewall **9200/tcp** if exposed to WAN.

 | **1789** | podman **`koopa-nym`** mixnet (nym.com nym-node) |