Fix

.gitignore

@@ -361,3 +361,6 @@ MigrationBackup/
 
 # Fody - auto-generated XML schema
 FodyWeavers.xsd
+# SSL certificates - copy cert.pfx into certs/ before building the Docker image
+certs/
+!certs/.gitkeep

Dockerfile

@@ -1,5 +1,5 @@
 FROM mcr.microsoft.com/dotnet/aspnet:10.0-preview AS base
-RUN apt-get update && apt-get upgrade -y && apt-get install -y openssl && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
 EXPOSE 8080
 EXPOSE 8443
@@ -32,23 +32,14 @@ LABEL org.opencontainers.image.title="Budgeteer" \
 # Ensure the SQLite data directory exists and is writable
 RUN mkdir -p /app/data
 
-# HSTS domain — used as the certificate CN and read by the app via Hsts:Domain config
+# HSTS domain — read by the app via Hsts:Domain config
 ENV Hsts__Domain=nas.oneputleygreen.com
 
-# Generate a self-signed TLS certificate for HTTPS
+# Copy the SSL certificate (CN=nas.oneputleygreen.com).
-RUN mkdir -p /app/certs && \
+# Place cert.pfx in the certs/ directory before building — it is excluded from git.
-    openssl req -x509 -newkey rsa:4096 \
+COPY certs/ /app/certs/
-        -keyout /app/certs/key.pem \
+RUN test -f /app/certs/cert.pfx || \
-        -out /app/certs/cert.pem \
+    (echo "ERROR: certs/cert.pfx not found. Copy your certificate into the certs/ directory before building." && exit 1)
-        -days 3650 \
-        -nodes \
-        -subj "/C=GB/ST=England/O=Budgeteer/CN=${Hsts__Domain}" && \
-    openssl pkcs12 -export \
-        -out /app/certs/cert.pfx \
-        -inkey /app/certs/key.pem \
-        -in /app/certs/cert.pem \
-        -passout pass: && \
-    rm /app/certs/key.pem /app/certs/cert.pem
 
 # Serve on both HTTP and HTTPS
 ENV ASPNETCORE_HTTP_PORTS=8181