feat: add Docker/OpenTofu deployment and DE/NL routing

deploy/scripts/renew-certificate.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+WM_DEPLOY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=common.sh
+source "$WM_DEPLOY_DIR/scripts/common.sh"
+wm_load_env
+wm_assert_data_mount
+
+if [[ "$(id -u)" -ne 0 ]]; then
+  wm_die "Dieses Skript muss als root ausgeführt werden."
+fi
+
+domain="${WATERMAPS_DOMAIN:-}"
+cert_name="$domain"
+if [[ "${WATERMAPS_CERTBOT_STAGING:-false}" == "true" ]]; then
+  cert_name="${domain}-staging"
+fi
+[[ -s "$WATERMAPS_DATA_DIR/certbot/letsencrypt/live/$cert_name/fullchain.pem" ]] || {
+  wm_log "Noch kein Zertifikat vorhanden; Erneuerung wird übersprungen."
+  exit 0
+}
+
+wm_compose --profile maintenance run --rm certbot \
+  renew \
+  --webroot \
+  --webroot-path /var/www/certbot \
+  --quiet
+
+wm_compose exec --no-TTY nginx nginx -t
+wm_compose exec --no-TTY nginx nginx -s reload
+wm_log "Zertifikatserneuerung geprüft und Nginx neu geladen."