From b60823b33a11e168f9685ed30b164433da20f47a Mon Sep 17 00:00:00 2001
From: boxswapper <boxswappers@gmail.com>
Date: Mon, 16 Mar 2026 20:06:51 -0600
Subject: [PATCH] updated certbot files

---
 .gitignore                                    |  1 +
 .../templates/Dockerfile-nginx-certbot.j2     | 11 +++++++++
 .../templates/certbot-entrypoint.sh           | 23 +++++++++++++++++++
 3 files changed, 35 insertions(+)

diff --git a/.gitignore b/.gitignore
index da84f24..3745b98 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 vault_pw
+*.key
\ No newline at end of file
diff --git a/roles/nginx-proxy/templates/Dockerfile-nginx-certbot.j2 b/roles/nginx-proxy/templates/Dockerfile-nginx-certbot.j2
index e69de29..686fd9c 100644
--- a/roles/nginx-proxy/templates/Dockerfile-nginx-certbot.j2
+++ b/roles/nginx-proxy/templates/Dockerfile-nginx-certbot.j2
@@ -0,0 +1,11 @@
+FROM nginx:1.25-alpine
+
+# Install Certbot (Python-based)
+RUN apk add --no-cache certbot python3 py3-pip
+
+# Add entrypoint script to auto-renew certs (optional)
+COPY certbot-entrypoint.sh /usr/local/bin/certbot-entrypoint.sh
+RUN chmod +x /usr/local/bin/certbot-entrypoint.sh
+
+ENTRYPOINT ["/usr/local/bin/certbot-entrypoint.sh"]
+CMD ["nginx", "-g", "daemon off;"]
\ No newline at end of file
diff --git a/roles/nginx-proxy/templates/certbot-entrypoint.sh b/roles/nginx-proxy/templates/certbot-entrypoint.sh
index e69de29..feb5aa4 100644
--- a/roles/nginx-proxy/templates/certbot-entrypoint.sh
+++ b/roles/nginx-proxy/templates/certbot-entrypoint.sh
@@ -0,0 +1,23 @@
+#!/bin/sh
+set -e
+
+# Generate cert if not exists (first-run)
+if [ ! -d "/etc/letsencrypt/live/{{ matrix_domain }}" ]; then
+  echo "Requesting initial Let's Encrypt certificate..."
+  certbot certonly --standalone \
+    --non-interactive --agree-tos --email admin@{{ matrix_domain }} \
+    -d {{ matrix_domain }} \
+    --domain {{ matrix_domain }} \
+    --preferred-challenges http \
+    --http-01-port 8080 \
+    --server https://acme-v02.api.letsencrypt.org/directory || true
+
+  # For staging (dev): use --server https://acme-staging-v02.api.letsencrypt.org/directory
+fi
+
+# Try to renew (non-blocking)
+echo "Attempting certificate renewal..."
+certbot renew --dry-run --quiet || true
+
+# Start Nginx (certs will be loaded if they exist)
+exec "$@"
\ No newline at end of file