Add HTTPS configuration and clean up old deployment config files

.gitignore

@@ -141,3 +141,7 @@ tests-ui/screenshots/
 *.docx#
 
 publications/static/OPTIMAP_Data-Privacy-Concept.docx
+
+certbot/conf/
+
+certbot/www/

README.md

@@ -346,7 +346,8 @@ The **logos** and favicon are in the repository in the folder [`publications/sta
 
 ## Deploy
 
-~~Deploy using `docker-compose` or see [`fly.io.md`](fly.io.md) for notes on deploying to Fly.io.~~
+The app is deployed in the TUD Enterprise Cloud.
+HTTPS certificate is retrieved via `certbot`, see `docker-compose.deploy.yml` for the configuration and documentation links.
 
 ## Operation
 

docker-compose.deploy.yml

@@ -43,10 +43,20 @@ services:
     image: nginx:1.27-alpine
     volumes:
       - "./etc/nginx.deploy.conf:/etc/nginx/nginx.conf:ro"
+      - "./certbot/www/:/var/www/certbot/:ro"
+      - "./certbot/conf/:/etc/nginx/ssl/:ro"
     ports:
       - "80:80"
+      - "443:443"
     depends_on:
-      - app
+       - app
+    restart: always
+
+  certbot:
+    image: certbot/certbot:latest
+    volumes:
+      - "./certbot/www/:/var/www/certbot/:rw"
+      - "./certbot/conf/:/etc/letsencrypt/:rw"
 
 volumes:
   optimap-volume:

etc/nginx.deploy.conf

@@ -1,5 +1,5 @@
 
-worker_processes 1;
+worker_processes auto;
 
 events {
     worker_connections 1024;
@@ -18,6 +18,30 @@ http {
 
     server {
         listen 80;
+        listen [::]:80;
+        server_name optimap.geo.tu-dresden.de;
+
+        # https://xavierz.dev/blog/posts/certbot-docker
+        location /.well-known/acme-challenge/ {
+            root /var/www/certbot;
+        }
+
+        location / {
+            return 301 https://$host$request_uri;
+        }
+
+    }
+
+    server {
+        listen 443 ssl;
+        listen [::]:443 ssl;
+        http2 on; # https://aruljohn.com/blog/nginx-listen-http2-directive-deprecated/
+        server_name optimap.geo.tu-dresden.de;
+
+        # via certbot, see https://xavierz.dev/blog/posts/certbot-docker
+        ssl_certificate /etc/nginx/ssl/live/optimap.geo.tu-dresden.de/fullchain.pem;
+        ssl_certificate_key /etc/nginx/ssl/live/optimap.geo.tu-dresden.de/privkey.pem;
+
         server_name optimap.geo.tu-dresden.de;
 
         location / {