Add automatic SSL certificate generation

terraform/modules/app_server/cloud-init.yaml.tpl

@@ -229,4 +229,20 @@ runcmd:
   - systemctl enable unattended-upgrades
   - systemctl start unattended-upgrades
 
-final_message: "Realms app server ready after $UPTIME seconds. Deploy via Forgejo CI/CD."
+  # Install certbot for SSL certificates
+  - DEBIAN_FRONTEND=noninteractive apt-get -o DPkg::Lock::Timeout=60 install -y certbot
+
+  # Create directories for certbot webroot
+  - mkdir -p /opt/realms/certbot_webroot
+
+  # Obtain initial SSL certificate (standalone mode - no webserver running yet)
+  # This runs before Docker services start, so port 80 is free
+  - |
+    certbot certonly --standalone \
+      --non-interactive \
+      --agree-tos \
+      --email ${letsencrypt_email} \
+      -d ${domain} \
+      || echo "Certbot failed - certificate may need to be obtained manually after DNS propagates"
+
+final_message: "Realms app server ready after $UPTIME seconds. SSL cert obtained for ${domain}. Deploy via Forgejo CI/CD."