deploy: add nginx-proxy reverse proxy for webhook TLS

docker-compose.yml.example

@@ -1,30 +1,61 @@
 services:
+  nginx-proxy:
+    image: nginxproxy/nginx-proxy:1.11.6-alpine
+    restart: always
+    ports:
+      - '80:80'
+      - '443:443'
+    environment:
+      # Bare-IP access only.
+      # DEFAULT_HOST: 'bot.example.com'
+    volumes:
+      - /var/run/docker.sock:/tmp/docker.sock:ro
+      - ./nginx-certs:/etc/nginx/certs:ro
+      - ./nginx-vhost.d:/etc/nginx/vhost.d:ro
+      - ./nginx-html:/usr/share/nginx/html:ro
+    networks: [proxy]
+    labels:
+      - 'com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy=true'
+
+  acme-companion:
+    image: nginxproxy/acme-companion
+    restart: always
+    environment:
+      DEFAULT_EMAIL: 'admin@yoursfunny.top'
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./nginx-certs:/etc/nginx/certs:rw
+      - ./nginx-vhost.d:/etc/nginx/vhost.d:rw
+      - ./nginx-html:/usr/share/nginx/html:rw
+      - ./nginx-acme:/etc/acme.sh
+    networks: [proxy]
+    depends_on:
+      - nginx-proxy
+
   tgxmb:
     image: yoursfunny/telegram-twitter-media-bot:latest
     restart: always
-#    ports:
-#      - "8443:8443"
     environment:
-      # docker-entrypoint.sh drops privileges to this uid.
       LOCAL_USER_ID: '1000'
-      # Bot token (BotFather). Required.
       TELOXIDE_TOKEN: ''
-      # Comma-separated admin chat ids; receives startup/shutdown notices.
       BOT_ADMIN: ''
-      # Required for pixiv support; pixiv is disabled when unset.
       PIXIV_REFRESH_TOKEN: ''
-      # Edit-before-forward records expire after this many seconds (default 86400 = 24h).
       EDIT_MESSAGE_TTL_SECONDS: '86400'
       RUST_LOG: 'info'
-      # Webhook mode is off by default (polling). The listener binds inside the
-      # container, so use 0.0.0.0 and publish the port if you enable it.
-      WEBHOOK: 'false'
+      VIRTUAL_HOST: 'bot.example.com'
+      VIRTUAL_PORT: '8443'
+      # LETSENCRYPT_HOST: 'bot.example.com'
+      WEBHOOK: 'true'
       WEBHOOK_LISTEN: '0.0.0.0'
       WEBHOOK_PORT: '8443'
-      WEBHOOK_URL: 'https://example.com'
-      WEBHOOK_CERT: './cert/cert.pem'
-      WEBHOOK_SECRET_TOKEN: 'secret-token'
+      WEBHOOK_URL: 'https://bot.example.com/'
+      # WEBHOOK_CERT: './cert/cert.pem'
+      WEBHOOK_SECRET_TOKEN: ''
     volumes:
       - ./data:/app/data
-#      - ./cert:/app/cert
+    networks: [proxy]
     container_name: tgxmb
+
+networks:
+  proxy:
+    name: proxy