feat: add optional letsencrypt tls

docker-compose.yml

@@ -77,13 +77,20 @@ services:
       - no-new-privileges:true
 
   proxy:
-    image: nginx:1.30.0-alpine
+    build:
+      context: ./nginx
     restart: unless-stopped
     init: true
+    environment:
+      LETSENCRYPT_ENABLED: ${LETSENCRYPT_ENABLED:-0}
+      LETSENCRYPT_DOMAIN: ${LETSENCRYPT_DOMAIN:-azionelab.org}
+      TLS_RELOAD_INTERVAL_SECONDS: ${TLS_RELOAD_INTERVAL_SECONDS:-30}
     volumes:
-      - ./nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
+      - letsencrypt_data:/etc/letsencrypt:ro
+      - certbot_challenges:/var/www/certbot:ro
     ports:
       - "${NGINX_BIND_ADDRESS:-127.0.0.1}:${NGINX_HTTP_PORT:-8080}:80"
+      - "${NGINX_BIND_ADDRESS:-127.0.0.1}:${NGINX_HTTPS_PORT:-8443}:443"
     depends_on:
       backend:
         condition: service_healthy
@@ -93,7 +100,7 @@ services:
       test:
         [
           "CMD-SHELL",
-          "wget -q -O /dev/null --header='Host: azionelab.org' http://127.0.0.1/health/ || exit 1",
+          "wget -q -O /dev/null http://127.0.0.1/nginx-health || exit 1",
         ]
       interval: 10s
       timeout: 5s
@@ -102,6 +109,36 @@ services:
     security_opt:
       - no-new-privileges:true
 
+  certbot:
+    image: certbot/certbot:v5.6.0
+    restart: unless-stopped
+    init: true
+    read_only: true
+    environment:
+      LETSENCRYPT_DOMAIN: ${LETSENCRYPT_DOMAIN:-azionelab.org}
+      LETSENCRYPT_EMAIL: "${LETSENCRYPT_EMAIL:-}"
+      LETSENCRYPT_STAGING: ${LETSENCRYPT_STAGING:-1}
+      LETSENCRYPT_RENEW_INTERVAL_SECONDS: ${LETSENCRYPT_RENEW_INTERVAL_SECONDS:-43200}
+      LETSENCRYPT_RETRY_SECONDS: ${LETSENCRYPT_RETRY_SECONDS:-300}
+    entrypoint: ["/bin/sh", "/opt/certbot/renew.sh"]
+    volumes:
+      - ./certbot/renew.sh:/opt/certbot/renew.sh:ro
+      - letsencrypt_data:/etc/letsencrypt
+      - certbot_challenges:/var/www/certbot
+    tmpfs:
+      - /tmp
+      - /var/lib/letsencrypt
+      - /var/log/letsencrypt
+    depends_on:
+      proxy:
+        condition: service_healthy
+    deploy:
+      replicas: ${LETSENCRYPT_ENABLED:-0}
+    security_opt:
+      - no-new-privileges:true
+
 volumes:
   postgres_data:
   media_data:
+  letsencrypt_data:
+  certbot_challenges: