Add NASA family service hub and Cloudflare deployment

.gitea/workflows/deploy-nasa.yml

@@ -0,0 +1,25 @@
+name: Deploy nasa (www.nasa.family)
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "nasa/**"
+      - ".gitea/workflows/deploy-nasa.yml"
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      # Absolute URLs match the other Gitea deployment workflows.
+      - name: Checkout
+        uses: https://github.com/actions/checkout@v4
+
+      - name: Deploy
+        uses: https://github.com/cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          wranglerVersion: "4"
+          workingDirectory: nasa

nasa/.assetsignore

@@ -0,0 +1,5 @@
+wrangler.toml
+README.md
+.assetsignore
+node_modules
+.wrangler

nasa/README.md

@@ -0,0 +1,35 @@
+# NASA Family service hub
+
+Single-file service directory at `www.nasa.family`. `index.html` includes
+all styles, JavaScript, and service icons; no build or external assets are needed.
+
+## Preview
+
+From this directory:
+
+```sh
+python -m http.server 8000
+```
+
+Open `http://localhost:8000`.
+
+## Deploy
+
+`.gitea/workflows/deploy-nasa.yml` deploys this directory as static assets
+to the Cloudflare Worker named `nasa` when changes to `nasa/**` or the workflow
+are pushed to `main`.
+
+The workflow reuses the repository's `CLOUDFLARE_API_TOKEN` and
+`CLOUDFLARE_ACCOUNT_ID` secrets. The token must permit Worker deployments
+in that account. The `nasa.family` zone must be in that same account for the
+configured `www.nasa.family` custom domain. Cloudflare manages its DNS record
+and certificate during deployment; an existing CNAME at `www` must be removed
+before the custom domain can be attached.
+
+For a manual deployment with Wrangler installed and authenticated:
+
+```sh
+npx wrangler@4 deploy
+```
+
+`.assetsignore` excludes deployment configuration and documentation from public assets.

nasa/wrangler.toml

@@ -0,0 +1,11 @@
+# Static service hub, deployed independently from portfolio and noo.
+name = "nasa"
+compatibility_date = "2026-10-06"
+
+routes = [
+  { pattern = "www.nasa.family", custom_domain = true }
+]
+
+[assets]
+directory = "."
+not_found_handling = "404-page"