Declare npmctl managed TLS certificates

Author: cobycloud

.github/workflows/deploy.yml

@@ -72,7 +72,7 @@ jobs:
       - name: Validate Docker proxy target
         run: npm run proxy:target-check
       - name: Validate npmctl proxy desired state
-        run: npmctl validate desired-state/proxy.yaml
+        run: npmctl validate .tmp/npmctl/proxy.yaml
       - name: Build site image
         run: docker-compose -f docker-compose.yaml build docs-swarmauri-com
       - name: Restart site container
@@ -99,8 +99,8 @@ jobs:
         continue-on-error: true
         run: npmctl schema check
       - name: Adopt matching unmanaged NPM resources
-        run: npmctl adopt desired-state/proxy.yaml --owner docs-swarmauri-com --force
+        run: npmctl adopt .tmp/npmctl/proxy.yaml --owner docs-swarmauri-com --force
       - name: Plan Nginx Proxy Manager host with npmctl
-        run: npmctl plan desired-state/proxy.yaml --owner docs-swarmauri-com
+        run: npmctl plan .tmp/npmctl/proxy.yaml --owner docs-swarmauri-com
       - name: Apply Nginx Proxy Manager host with npmctl
-        run: npmctl apply desired-state/proxy.yaml --owner docs-swarmauri-com
+        run: npmctl apply .tmp/npmctl/proxy.yaml --owner docs-swarmauri-com

desired-state/proxy.yaml

@@ -1,17 +1,38 @@
 ---
 apiVersion: npmctl.com/v1
 schemaVersion: 2
+certificates:
+  - name: docs-swarmauri-com-letsencrypt
+    domain_names:
+      - docs.swarmauri.com
+    certificate_type: letsencrypt
+    api_payload:
+      provider: letsencrypt
+      meta:
+        letsencrypt_email: "__NPM_IDENTITY__"
+        letsencrypt_agree: true
+        dns_challenge: false
+        managed_by: npmctl
+        owner: docs-swarmauri-com
+        resource_id: cert.docs-swarmauri-com
+    meta:
+      managed_by: npmctl
+      owner: docs-swarmauri-com
+      resource_id: cert.docs-swarmauri-com
 proxy_hosts:
   - domain_names:
       - docs.swarmauri.com
     forward_scheme: http
     forward_host: docs-swarmauri-com
     forward_port: 80
+    certificate_ref: cert.docs-swarmauri-com
     ssl_forced: 1
     http2_support: 1
+    hsts_enabled: 1
+    hsts_subdomains: 0
     allow_websocket_upgrade: 1
     block_exploits: 1
     meta:
       managed_by: npmctl
       owner: docs-swarmauri-com
-      resource_id: proxy.docs-swarmauri-com
+      resource_id: proxy.docs-swarmauri-com