Add post-quantum hybrid ECDHE-MLKEM for TLSv1.3 in our webserver

[bwbroersma]

Related:

• Should we start checking for PQC ? #1640

Pull Request:

• Uses nginx:1.29.1-alpine3.22 for main proxy instead of previous debian based nginx:1.27.3
  • changed healthcheck from service nginx status to curl -kfsSo/dev/null https://$INTERNETNL_DOMAINNAME --resolve $INTERNETNL_DOMAINNAME:443:127.0.0.1
  • added ssl_ecdh_curve SecP384r1MLKEM1024:X25519MLKEM768:SecP256r1MLKEM768:...
• Upgraded other nginx:1.27.3-alpine images to nginx:1.29.1-alpine3.22

Result:

openssl s_client -connect 127.0.0.1:443 -servername internet.test -groups X25519MLKEM768 |grep group

Connecting to 127.0.0.1
depth=0 CN=internet.test
verify error:num=18:self-signed certificate
verify return:1
depth=0 CN=internet.test
verify return:1
Negotiated TLS1.3 group: X25519MLKEM768

Update: there seems to be a bug regarding fetching the wrong env logs, now that is solved I suspect the health-check is not working because of authentication. There are multiple solutions:

1. Check if the process is running ps -ef | grep nginx
2. Port is still used netstat -a | grep 443
3. Testing sectxt curl https://$INTERNETNL_DOMAINNAME/.well-known/security.txt
4. Remove the -f flag
5. Adding optional authentication to the health check

Picked nr. 5 one, since it's actually the most 'full' test, with -f it was actually not just testing the webserver health, but also the app container (which is wrong, since restarting the webserver won't solve any app container issues).