feat: per-container private key renewal

[JamBalaya56562]

What

Allow RENEW_PRIVATE_KEYS to be overridden per proxied container via a new LETSENCRYPT_RENEW_PRIVATE_KEYS variable, instead of only globally on the companion.

Why

RENEW_PRIVATE_KEYS could only be set globally, so it was all-or-nothing. The reporter (#1191) wants to keep a stable private key for one certificate — a DANE/TLSA mail cert (rspamd), where rotating the key would break published TLSA records — while still rotating keys on every renewal for their other web certificates. There was no way to do that short of running a second companion instance.

How

Follows the existing per-container nameref pattern (same as ACME_${cid}_RENEW_AFTER, LETSENCRYPT_${cid}_KEYSIZE, etc.):

• app/letsencrypt_service — update_cert now reads LETSENCRYPT_${cid}_RENEW_PRIVATE_KEYS and falls back to the global RENEW_PRIVATE_KEYS when unset, before deciding whether to pass acme.sh --always-force-new-domain-key.
• app/letsencrypt_service_data.tmpl — surfaces LETSENCRYPT_RENEW_PRIVATE_KEYS from the proxied container into the per-container data (both the SAN and single-domain-cert branches).
• docs/Container-configuration.md — documents the per-container override.
• test/tests/renew_private_keys/ — integration test: a container with LETSENCRYPT_RENEW_PRIVATE_KEYS=false must keep the same private key across a forced renewal, even though the companion's global default (true) would otherwise rotate it. Registered in test/config.sh and the CI matrix.

The global RENEW_PRIVATE_KEYS (and the legacy REUSE_PRIVATE_KEYS) behaviour is unchanged when the per-container variable is not set.

Testing

• New renew_private_keys integration test added (CI, 2containers).
• Verified locally that the template renders the new variable correctly (docker-gen emits LETSENCRYPT_<cid>_RENEW_PRIVATE_KEYS="false" for a container setting LETSENCRYPT_RENEW_PRIVATE_KEYS=false).
• shellcheck clean on the modified script and the new test.

Closes #1191

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds a per-proxied-container override for private key rotation on renewal, enabling stable keys for specific certificates (e.g., DANE/TLSA mail certs) while keeping the global default behavior for everything else.

Changes:

• Add LETSENCRYPT_RENEW_PRIVATE_KEYS support via docker-gen templating into per-container variables.
• Update certificate issuance logic to honor LETSENCRYPT_${cid}_RENEW_PRIVATE_KEYS (with fallback to global RENEW_PRIVATE_KEYS).
• Add an integration test and register it in CI and the test suite.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
app/letsencrypt_service	Reads per-container RENEW_PRIVATE_KEYS override and conditionally passes --always-force-new-domain-key.
app/letsencrypt_service_data.tmpl	Exposes LETSENCRYPT_RENEW_PRIVATE_KEYS from proxied containers into generated per-container env.
docs/Container-configuration.md	Documents the per-container override behavior.
test/tests/renew_private_keys/run.sh	New integration test to verify key reuse across a forced renewal when override is false.
test/config.sh	Registers the new test in the global test list.
.github/workflows/test.yml	Adds the new test to the CI matrix (2containers).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.