# Terraform Nginx HTTPS (No Cloud)

Spin up an **Nginx** container with **HTTPS** using a **self-signed** certificate, all managed by **Terraform**. Good for local/dev testing.

## Prereqs
- Docker (engine + permission to bind mount files)
- Terraform v1.x

## Structure
```
tf-nginx-https/
├─ main.tf
├─ variables.tf
├─ outputs.tf
├─ files/
│  ├─ nginx.conf                 # template (uses ${domain})
│  ├─ .rendered_nginx.conf       # generated by Terraform
│  └─ index.html
└─ certs/                        # generated (self-signed cert + key)
```

## Quick Start
```bash
terraform init
terraform apply -auto-approve
```

- By default it serves `sananetco.com` on your machine's ports **80/443**.
- If your DNS does not point to this host, add a temporary entry to your `/etc/hosts` (Linux/macOS) or `C:\Windows\System32\drivers\etc\hosts` (Windows):
```
<YOUR_SERVER_IP> sananetco.com www.sananetco.com
```
Then open: `https://sananetco.com`. Your browser will warn about the **self-signed** cert (expected for dev).

## Variables
You can override at apply time:
```bash
terraform apply -auto-approve \
  -var='domain=sananetco.com' \
  -var='http_port=80' \
  -var='https_port=443' \
  -var='container_name=nginx_tls' \
  -var='dev_self_signed_days=365'
```

## Clean Up
```bash
terraform destroy -auto-approve
```

## Upgrade to Real TLS (Let's Encrypt)
1) Keep Nginx running and ensure ports **80/443** are reachable on the Internet and DNS for your domain points to this host.  
2) Use a `certbot` container (webroot) to issue certs into `./certs`, then update the Nginx config to point to the LE paths and reload.

Example (manual, outside Terraform):
```bash
docker run --rm \
  -v $(pwd)/certs:/etc/letsencrypt \
  -v $(pwd)/files:/var/www/html \
  certbot/certbot certonly --webroot \
  -w /var/www/html \
  -d sananetco.com -d www.sananetco.com \
  --agree-tos -m you@example.com --non-interactive
```

Then switch Nginx ssl paths to:
```
/etc/letsencrypt/live/sananetco.com/fullchain.pem
/etc/letsencrypt/live/sananetco.com/privkey.pem
```
Bind mount that folder into the container and reload:
```bash
docker exec nginx_tls nginx -s reload
```

If you want the whole Let’s Encrypt flow encapsulated inside Terraform (with a `docker_container` for certbot + a `null_resource` for reload), I can provide a second module.