yellow: Install/configure nginx

We're going to use *nginx* as the reverse proxy in front of Home
Assistant, as well as the web consoles for Zigbee2MQTT and ZWaveJS2MQTT.
It will provide TLS termination for all of these applications.

Since *nginx* will not start without a certificate and private key file
for HTTPS, the *gen-nginx-cert.service* systemd unit generates a
self-signed certificate if one does not already exist.  This ensures
that *nginx* can start by default, but still allows the administrator to
replace the certificate with a trusted one later.

The *nginx* container image has symlinks at `/var/log/nginx/error.log`
and `/var/log/nginx/access.log`, pointing to `/dev/stderr` and
`/dev/stdout`, respectively.  The intent here is to send all log
messages to the container runtime.  Unfortunately, when the the
container is managed by Podman from a systemd unit, the standard output
and standard error streams are connected to the systemd journal via a
UNIX socket.  As a result, the `/dev/stdout` and `/dev/stderr`
pseudo-files cannot be "opened" like normal files or pipes.  Thus, to
forward nginx's logs to the systemd journal correctly, we have to do a
bit of trickery.  For the error log at least, setting `error_log stderr`
works well; nginx simply writes messages to the existing file
descriptor.  Unfortunately, the access log has no such mechanism.  For
that, we use nginx's syslog capabilities.  The `/dev/log` socket is
bind-mounted into the container, and nginx is configured to connect to
it.

yellow/overlay/etc/systemd/system/gen-nginx-cert.service

@@ -0,0 +1,40 @@
+# vim: set ft=systemd :
+[Unit]
+Description=Generate self-signed certificate for nginx
+Before=nginx.service
+ConditionPathExists=!/etc/nginx/ssl/server.crt
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/gen-nginx-cert
+User=root
+Group=nginx
+CapabilityBoundingSet=
+DeviceAllow=
+DevicePolicy=closed
+IPAddressDeny=any
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+PrivateDevices=yes
+PrivateNetwork=yes
+PrivateTmp=yes
+PrivateUsers=yes
+ProcSubset=pid
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectProc=invisible
+ProtectSystem=yes
+RestrictAddressFamilies=
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged
+UMask=0027