From 3ca8082deb8047d633a476dae7ca0c1c972964d1 Mon Sep 17 00:00:00 2001
From: Ross Miller <rossajmiller76@gmail.com>
Date: Sat, 7 Mar 2026 11:46:19 +0000
Subject: [PATCH] Fix

---
 .gitignore     |  2 +-
 Dockerfile     | 22 ++++++++++++++++++----
 certs/.gitkeep |  0
 3 files changed, 19 insertions(+), 5 deletions(-)
 create mode 100644 certs/.gitkeep

diff --git a/.gitignore b/.gitignore
index c8183fb..8942ca0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -362,5 +362,5 @@ MigrationBackup/
 # Fody - auto-generated XML schema
 FodyWeavers.xsd
 # SSL certificates - copy cert.pfx into certs/ before building the Docker image
-certs/
+certs/*
 !certs/.gitkeep
diff --git a/Dockerfile b/Dockerfile
index 8ccff12..2c349dd 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 FROM mcr.microsoft.com/dotnet/aspnet:10.0-preview AS base
-RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get upgrade -y && apt-get install -y openssl && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
 EXPOSE 8080
 EXPOSE 8443
@@ -36,10 +36,24 @@ RUN mkdir -p /app/data
 ENV Hsts__Domain=nas.oneputleygreen.com
 
 # Copy the SSL certificate (CN=nas.oneputleygreen.com).
-# Place cert.pfx in the certs/ directory before building — it is excluded from git.
+# Place cert.pfx in certs/ before building — excluded from git via certs/* in .gitignore.
+# If cert.pfx is absent (e.g. CI builds) a self-signed fallback is generated automatically.
 COPY certs/ /app/certs/
-RUN test -f /app/certs/cert.pfx || \
-    (echo "ERROR: certs/cert.pfx not found. Copy your certificate into the certs/ directory before building." && exit 1)
+RUN if [ ! -f /app/certs/cert.pfx ]; then \
+        echo "No cert.pfx found — generating self-signed certificate for ${Hsts__Domain}" && \
+        openssl req -x509 -newkey rsa:4096 \
+            -keyout /app/certs/key.pem \
+            -out /app/certs/cert.pem \
+            -days 3650 \
+            -nodes \
+            -subj "/C=GB/ST=England/O=Budgeteer/CN=${Hsts__Domain}" && \
+        openssl pkcs12 -export \
+            -out /app/certs/cert.pfx \
+            -inkey /app/certs/key.pem \
+            -in /app/certs/cert.pem \
+            -passout pass: && \
+        rm /app/certs/key.pem /app/certs/cert.pem; \
+    fi
 
 # Serve on both HTTP and HTTPS
 ENV ASPNETCORE_HTTP_PORTS=8181
diff --git a/certs/.gitkeep b/certs/.gitkeep
new file mode 100644
index 0000000..e69de29