feat(deployment): add SSL support with automated certificate management

- Introduce production Docker Compose override for SSL port and volume mapping
- Add Nginx SSL template configuration with security headers and proxy settings
- Create setup script for Certbot installation, certificate generation, and cron-based renewal
- Enable HTTPS redirection and secure API/socket.io routing

Author: christopherldo

apps/web/nginx-ssl.template.conf

@@ -0,0 +1,49 @@
+server {
+  listen 80;
+  server_name YOUR_DOMAIN;
+  return 301 https://$host$request_uri;
+}
+
+server {
+  listen 443 ssl;
+  server_name YOUR_DOMAIN;
+
+  ssl_certificate /etc/letsencrypt/live/YOUR_DOMAIN/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/YOUR_DOMAIN/privkey.pem;
+
+  # Configurações de Segurança SSL
+  ssl_protocols TLSv1.2 TLSv1.3;
+  ssl_prefer_server_ciphers on;
+  ssl_ciphers HIGH:!aNULL:!MD5;
+
+  root /usr/share/nginx/html;
+  index index.html;
+
+  location = / {
+    try_files /index.html =404;
+    add_header Cache-Control "public, max-age=300, must-revalidate";
+  }
+
+  location / {
+    try_files $uri $uri/ /spa.html;
+    add_header Cache-Control "public, max-age=300, must-revalidate";
+  }
+
+  location /api/ {
+    proxy_pass http://api:3000/;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+
+  location /socket.io/ {
+    proxy_pass http://api:3000/socket.io/;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "Upgrade";
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+  }
+}

docker-compose.prod.yaml

@@ -0,0 +1,7 @@
+services:
+  web:
+    ports:
+      - "443:443"
+    volumes:
+      - /etc/letsencrypt:/etc/letsencrypt:ro
+      - ./apps/web/nginx-prod.conf:/etc/nginx/conf.d/default.conf:ro

scripts/setup-ssl.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+
+DOMAIN=$1
+EMAIL=$2
+
+if [ -z "$DOMAIN" ] || [ -z "$EMAIL" ]; then
+  echo "Uso: bash scripts/setup-ssl.sh <seu-dominio.com> <seu-email@exemplo.com>"
+  exit 1
+fi
+
+echo "=========================================="
+echo "1. Instalando Certbot no Amazon Linux 2023"
+echo "=========================================="
+sudo dnf install -y python3 augeas-libs
+sudo python3 -m venv /opt/certbot/
+sudo /opt/certbot/bin/pip install --upgrade pip
+sudo /opt/certbot/bin/pip install certbot
+sudo ln -sf /opt/certbot/bin/certbot /usr/bin/certbot
+
+echo "=========================================="
+echo "2. Parando o servidor web para liberar a porta 80"
+echo "=========================================="
+docker compose stop web
+
+echo "=========================================="
+echo "3. Gerando certificado SSL para $DOMAIN"
+echo "=========================================="
+# O Certbot vai subir um servidor temporário na porta 80 para validar o domínio
+sudo certbot certonly --standalone -d $DOMAIN -m $EMAIL --agree-tos --non-interactive
+
+if [ ! -d "/etc/letsencrypt/live/$DOMAIN" ]; then
+  echo "❌ Falha ao gerar o certificado SSL. Verifique se o DNS propagou."
+  docker compose start web
+  exit 1
+fi
+
+echo "=========================================="
+echo "4. Configurando Nginx para usar SSL"
+echo "=========================================="
+# Substitui o domínio no template de configuração e gera o arquivo de produção
+sed "s/YOUR_DOMAIN/$DOMAIN/g" apps/web/nginx-ssl.template.conf > apps/web/nginx-prod.conf
+
+echo "=========================================="
+echo "5. Iniciando os containers com suporte a SSL"
+echo "=========================================="
+docker compose -f docker-compose.yaml -f docker-compose.prod.yaml up -d
+
+echo "=========================================="
+echo "6. Configurando renovação automática (Cron)"
+echo "=========================================="
+# O cron rodará todo dia de madrugada, parando o container apenas se for renovar, e depois ligando novamente.
+CRON_CMD="0 3 * * * root /opt/certbot/bin/certbot renew -q --pre-hook \"cd $(pwd) && docker compose stop web\" --post-hook \"cd $(pwd) && docker compose -f docker-compose.yaml -f docker-compose.prod.yaml start web\""
+echo "$CRON_CMD" | sudo tee /etc/cron.d/certbot-renew > /dev/null
+
+echo "=========================================="
+echo "✅ SSL configurado com sucesso para https://$DOMAIN!"
+echo "=========================================="