yellow: Install/configure nginx

We're going to use *nginx* as the reverse proxy in front of Home
Assistant, as well as the web consoles for Zigbee2MQTT and ZWaveJS2MQTT.
It will provide TLS termination for all of these applications.

Since *nginx* will not start without a certificate and private key file
for HTTPS, the *gen-nginx-cert.service* systemd unit generates a
self-signed certificate if one does not already exist.  This ensures
that *nginx* can start by default, but still allows the administrator to
replace the certificate with a trusted one later.

The *nginx* container image has symlinks at `/var/log/nginx/error.log`
and `/var/log/nginx/access.log`, pointing to `/dev/stderr` and
`/dev/stdout`, respectively.  The intent here is to send all log
messages to the container runtime.  Unfortunately, when the the
container is managed by Podman from a systemd unit, the standard output
and standard error streams are connected to the systemd journal via a
UNIX socket.  As a result, the `/dev/stdout` and `/dev/stderr`
pseudo-files cannot be "opened" like normal files or pipes.  Thus, to
forward nginx's logs to the systemd journal correctly, we have to do a
bit of trickery.  For the error log at least, setting `error_log stderr`
works well; nginx simply writes messages to the existing file
descriptor.  Unfortunately, the access log has no such mechanism.  For
that, we use nginx's syslog capabilities.  The `/dev/log` socket is
bind-mounted into the container, and nginx is configured to connect to
it.

yellow/overlay/etc/containers/systemd/nginx.container

@@ -0,0 +1,26 @@
+# vim: set ft=systemd :
+[Unit]
+After=network-online.target
+Wants=network-online.target
+Requires=gen-nginx-cert.service
+
+[Container]
+Image=docker.io/library/nginx
+Network=host
+Volume=/etc/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+Volume=/etc/nginx/conf.d:/etc/nginx/conf.d:ro
+Volume=/etc/nginx/ssl:/etc/nginx/ssl:ro
+Volume=/dev/log:/dev/log
+User=82
+Group=82
+AddCapability=CAP_NET_BIND_SERVICE
+ReadOnly=true
+VolatileTmp=yes
+
+[Service]
+ProtectSystem=full
+UMask=0077
+ExecReload=/usr/bin/podman exec systemd-%N nginx -s reload
+
+[Install]
+WantedBy=multi-user.target