From bdcd62263a2db462844aa28992423182b2cf052d Mon Sep 17 00:00:00 2001
From: Roni bhakta <77425964+ronibhakta1@users.noreply.github.com>
Date: Thu, 8 Oct 2026 19:31:06 +0530
Subject: [PATCH] fix: serve ACME HTTP-01 challenge on port 80 for certbot
 webroot renewal

---
 docker-compose.yml                             |  1 +
 nginx/templates/20-speech-server.conf.template | 10 +++++++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index b9fe943..f3b693e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -35,6 +35,7 @@ services:
       # collides with ours whenever DOMAIN=localhost. Null it out.
       - /dev/null:/etc/nginx/conf.d/default.conf:ro
       - /etc/letsencrypt:/etc/letsencrypt:ro
+      - /var/www/certbot:/var/www/certbot:ro
     depends_on:
       - app
     networks:
diff --git a/nginx/templates/20-speech-server.conf.template b/nginx/templates/20-speech-server.conf.template
index 521ad6c..7577de2 100644
--- a/nginx/templates/20-speech-server.conf.template
+++ b/nginx/templates/20-speech-server.conf.template
@@ -14,7 +14,15 @@ server {
 server {
     listen 80;
     server_name ${DOMAIN};
-    return 301 https://$host$request_uri;
+
+    # Let's Encrypt HTTP-01 challenge (certbot --webroot /var/www/certbot).
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
 }
 
 server {