updated certbot files

.gitignore

@@ -1 +1,2 @@
 vault_pw
+*.key

roles/nginx-proxy/templates/Dockerfile-nginx-certbot.j2

@@ -0,0 +1,11 @@
+FROM nginx:1.25-alpine
+
+# Install Certbot (Python-based)
+RUN apk add --no-cache certbot python3 py3-pip
+
+# Add entrypoint script to auto-renew certs (optional)
+COPY certbot-entrypoint.sh /usr/local/bin/certbot-entrypoint.sh
+RUN chmod +x /usr/local/bin/certbot-entrypoint.sh
+
+ENTRYPOINT ["/usr/local/bin/certbot-entrypoint.sh"]
+CMD ["nginx", "-g", "daemon off;"]

roles/nginx-proxy/templates/certbot-entrypoint.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+set -e
+
+# Generate cert if not exists (first-run)
+if [ ! -d "/etc/letsencrypt/live/{{ matrix_domain }}" ]; then
+  echo "Requesting initial Let's Encrypt certificate..."
+  certbot certonly --standalone \
+    --non-interactive --agree-tos --email admin@{{ matrix_domain }} \
+    -d {{ matrix_domain }} \
+    --domain {{ matrix_domain }} \
+    --preferred-challenges http \
+    --http-01-port 8080 \
+    --server https://acme-v02.api.letsencrypt.org/directory || true
+
+  # For staging (dev): use --server https://acme-staging-v02.api.letsencrypt.org/directory
+fi
+
+# Try to renew (non-blocking)
+echo "Attempting certificate renewal..."
+certbot renew --dry-run --quiet || true
+
+# Start Nginx (certs will be loaded if they exist)
+exec "$@"