Fix

.gitignore

@@ -362,5 +362,5 @@ MigrationBackup/
 # Fody - auto-generated XML schema
 FodyWeavers.xsd
 # SSL certificates - copy cert.pfx into certs/ before building the Docker image
-certs/
+certs/*
 !certs/.gitkeep

Dockerfile

@@ -1,5 +1,5 @@
 FROM mcr.microsoft.com/dotnet/aspnet:10.0-preview AS base
-RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get upgrade -y && apt-get install -y openssl && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
 EXPOSE 8080
 EXPOSE 8443
@@ -36,10 +36,24 @@ RUN mkdir -p /app/data
 ENV Hsts__Domain=nas.oneputleygreen.com
 
 # Copy the SSL certificate (CN=nas.oneputleygreen.com).
-# Place cert.pfx in the certs/ directory before building — it is excluded from git.
+# Place cert.pfx in certs/ before building — excluded from git via certs/* in .gitignore.
+# If cert.pfx is absent (e.g. CI builds) a self-signed fallback is generated automatically.
 COPY certs/ /app/certs/
-RUN test -f /app/certs/cert.pfx || \
-    (echo "ERROR: certs/cert.pfx not found. Copy your certificate into the certs/ directory before building." && exit 1)
+RUN if [ ! -f /app/certs/cert.pfx ]; then \
+        echo "No cert.pfx found — generating self-signed certificate for ${Hsts__Domain}" && \
+        openssl req -x509 -newkey rsa:4096 \
+            -keyout /app/certs/key.pem \
+            -out /app/certs/cert.pem \
+            -days 3650 \
+            -nodes \
+            -subj "/C=GB/ST=England/O=Budgeteer/CN=${Hsts__Domain}" && \
+        openssl pkcs12 -export \
+            -out /app/certs/cert.pfx \
+            -inkey /app/certs/key.pem \
+            -in /app/certs/cert.pem \
+            -passout pass: && \
+        rm /app/certs/key.pem /app/certs/cert.pem; \
+    fi
 
 # Serve on both HTTP and HTTPS
 ENV ASPNETCORE_HTTP_PORTS=8181