From 94ea77266e8054d0902692f3cb49ceb5eb9861e2 Mon Sep 17 00:00:00 2001
From: Ross Miller <rossajmiller76@gmail.com>
Date: Sat, 7 Mar 2026 11:41:07 +0000
Subject: [PATCH] Fix

---
 .gitignore |  5 ++++-
 Dockerfile | 23 +++++++----------------
 2 files changed, 11 insertions(+), 17 deletions(-)

diff --git a/.gitignore b/.gitignore
index 9491a2f..c8183fb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -360,4 +360,7 @@ MigrationBackup/
 .ionide/
 
 # Fody - auto-generated XML schema
-FodyWeavers.xsd
\ No newline at end of file
+FodyWeavers.xsd
+# SSL certificates - copy cert.pfx into certs/ before building the Docker image
+certs/
+!certs/.gitkeep
diff --git a/Dockerfile b/Dockerfile
index 79603f1..8ccff12 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 FROM mcr.microsoft.com/dotnet/aspnet:10.0-preview AS base
-RUN apt-get update && apt-get upgrade -y && apt-get install -y openssl && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
 EXPOSE 8080
 EXPOSE 8443
@@ -32,23 +32,14 @@ LABEL org.opencontainers.image.title="Budgeteer" \
 # Ensure the SQLite data directory exists and is writable
 RUN mkdir -p /app/data
 
-# HSTS domain — used as the certificate CN and read by the app via Hsts:Domain config
+# HSTS domain — read by the app via Hsts:Domain config
 ENV Hsts__Domain=nas.oneputleygreen.com
 
-# Generate a self-signed TLS certificate for HTTPS
-RUN mkdir -p /app/certs && \
-    openssl req -x509 -newkey rsa:4096 \
-        -keyout /app/certs/key.pem \
-        -out /app/certs/cert.pem \
-        -days 3650 \
-        -nodes \
-        -subj "/C=GB/ST=England/O=Budgeteer/CN=${Hsts__Domain}" && \
-    openssl pkcs12 -export \
-        -out /app/certs/cert.pfx \
-        -inkey /app/certs/key.pem \
-        -in /app/certs/cert.pem \
-        -passout pass: && \
-    rm /app/certs/key.pem /app/certs/cert.pem
+# Copy the SSL certificate (CN=nas.oneputleygreen.com).
+# Place cert.pfx in the certs/ directory before building — it is excluded from git.
+COPY certs/ /app/certs/
+RUN test -f /app/certs/cert.pfx || \
+    (echo "ERROR: certs/cert.pfx not found. Copy your certificate into the certs/ directory before building." && exit 1)
 
 # Serve on both HTTP and HTTPS
 ENV ASPNETCORE_HTTP_PORTS=8181