Added certbot to stack

cli/deploy.py

@@ -262,3 +262,35 @@ def prod_clean():
         rm("-rf", "static", "node_modules")
 
     logger.success("Clean complete. Re-create environment before next deploy.")
+
+
+@app.command()
+def init_ssl(
+    email: str = typer.Argument(
+        ..., help="Email address for Let's Encrypt registration"
+    ),
+    domain: str = typer.Argument(..., help="Domain name to fetch certificate for"),
+):
+    """Initialize Let's Encrypt SSL certificates for the first time."""
+    logger.info(f"Initializing Let's Encrypt SSL for {domain}...")
+
+    with local.cwd(REPO_DIR):
+        logger.info("Requesting certificate via certbot webroot...")
+        cmd = f"certbot certonly --webroot -w /var/www/certbot -d {domain} --email {email} --agree-tos --no-eff-email --force-renewal"
+        docker_compose("exec", "certbot", "sh", "-c", cmd)
+
+        logger.info("Restarting frontend to apply new certificates...")
+        docker_compose("restart", "frontend")
+
+    logger.success("SSL initialization complete!")
+
+
+@app.command()
+def renew_ssl():
+    """Manually force a renewal check for Let's Encrypt and reload Nginx."""
+    logger.info("Triggering manual SSL renewal check...")
+    with local.cwd(REPO_DIR):
+        docker_compose("exec", "certbot", "certbot", "renew")
+        logger.info("Reloading Nginx...")
+        docker_compose("exec", "frontend", "nginx", "-s", "reload")
+    logger.success("SSL renewal check complete!")

i-form-data-repository/docker-services.yml

@@ -43,6 +43,16 @@ services:
       options:
         max-size: "50m"
         max-file: "3"
+    volumes:
+      - certbot_conf:/etc/letsencrypt
+      - certbot_www:/var/www/certbot
+  certbot:
+    image: docker.io/certbot/certbot
+    restart: "unless-stopped"
+    volumes:
+      - certbot_conf:/etc/letsencrypt
+      - certbot_www:/var/www/certbot
+    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
   cache:
     image: docker.io/library/redis:7
     restart: "unless-stopped"
@@ -141,3 +151,6 @@ services:
       interval: 30s
       timeout: 20s
       retries: 3
+volumes:
+  certbot_conf:
+  certbot_www:

i-form-data-repository/docker/nginx/Dockerfile

@@ -2,4 +2,7 @@ FROM docker.io/library/nginx
 COPY nginx.conf /etc/nginx/nginx.conf
 COPY conf.d/* /etc/nginx/conf.d/
 COPY test.key /etc/ssl/private/test.key
-COPY test.crt /etc/ssl/certs/test.crt
+COPY test.crt /etc/ssl/certs/test.crt
+COPY entrypoint.sh /entrypoint.sh
+ENTRYPOINT ["/entrypoint.sh"]
+CMD ["nginx", "-g", "daemon off;"]

i-form-data-repository/docker/nginx/conf.d/default.conf

@@ -12,7 +12,14 @@ server {
   listen 80 default_server; # IPv4
   listen [::]:80 default_server; # IPv6
   server_name _;
-  return 301 https://$host$request_uri;
+
+  location /.well-known/acme-challenge/ {
+    root /var/www/certbot;
+  }
+
+  location / {
+    return 301 https://$host$request_uri;
+  }
 }
 
 # Upstream servers
@@ -35,8 +42,8 @@ server {
   # https://mozilla.github.io/server-side-tls/ssl-config-generator/
   # The provided certificate (test.crt) and private key (test.key) is only for
   # testing and must never be used in production environment.
-  ssl_certificate /etc/ssl/certs/test.crt;
-  ssl_certificate_key /etc/ssl/private/test.key;
+  ssl_certificate /etc/ssl/certs/invenio.crt;
+  ssl_certificate_key /etc/ssl/private/invenio.key;
   ssl_session_timeout 1d;
   ssl_session_cache shared:SSL:50m;
   ssl_session_tickets off;

i-form-data-repository/docker/nginx/entrypoint.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+
+# Check if Let's Encrypt live certificates exist
+if [ -d "/etc/letsencrypt/live" ] && [ "$(ls -A /etc/letsencrypt/live)" ]; then
+    # Certs exist, find the first domain folder (ignoring README)
+    DOMAIN=$(find /etc/letsencrypt/live -mindepth 1 -maxdepth 1 -type d | head -n 1 | xargs basename)
+    echo "Using Let's Encrypt certificates for $DOMAIN"
+    ln -sf /etc/letsencrypt/live/$DOMAIN/fullchain.pem /etc/ssl/certs/invenio.crt
+    ln -sf /etc/letsencrypt/live/$DOMAIN/privkey.pem /etc/ssl/private/invenio.key
+else
+    # Fallback to test certs
+    echo "Using fallback test certificates"
+    cp /etc/ssl/certs/test.crt /etc/ssl/certs/invenio.crt
+    cp /etc/ssl/private/test.key /etc/ssl/private/invenio.key
+fi
+
+# Execute the default CMD (nginx)
+exec "$@"