# Apache SSL certificates

This directory is mounted into the container at `/etc/apache2/ssl` (see `docker-compose.yml`).
Drop your TLS cert/key here. The actual `.crt`/`.key`/`.pem` files are gitignored — only this README is tracked.

## Files expected by the vhost config

For `jumpers.stormcloudhills.com` (`docker/apache/000-default.conf`):

| File | Purpose |
| --- | --- |
| `jumpers.stormcloudhills.com.crt` | Server certificate (SSLCertificateFile) |
| `jumpers.stormcloudhills.com.key` | Private key (SSLCertificateKeyFile) |
| `jumpers.stormcloudhills.com.chain.crt` | Optional CA chain/bundle (uncomment SSLCertificateChainFile to use) |

## Option A — Let's Encrypt (recommended for production)

Issue a cert on the host with certbot, then copy/symlink it in:

```sh
certbot certonly --standalone -d jumpers.stormcloudhills.com
cp /etc/letsencrypt/live/jumpers.stormcloudhills.com/fullchain.pem \
   docker/apache/ssl/jumpers.stormcloudhills.com.crt
cp /etc/letsencrypt/live/jumpers.stormcloudhills.com/privkey.pem \
   docker/apache/ssl/jumpers.stormcloudhills.com.key
```

Restart Apache after each renewal: `docker compose restart web`.

## Option B — Self-signed (local testing only; browsers will warn)

```sh
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout docker/apache/ssl/jumpers.stormcloudhills.com.key \
  -out    docker/apache/ssl/jumpers.stormcloudhills.com.crt \
  -subj "/CN=jumpers.stormcloudhills.com"
```