feat: mount the Home Assistant /ssl directory read-only (#873)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: cmatte

zigbee2mqtt-edge/config.json

@@ -34,6 +34,10 @@
       "type": "addon_config",
       "read_only": false,
       "path": "/addon_config"
+    },
+    {
+      "type": "ssl",
+      "read_only": true
     }
   ],
   "ports": {

zigbee2mqtt/CHANGELOG.md

@@ -1,3 +1,7 @@
+## [Unreleased]
+
+- Mount the Home Assistant SSL directory into the addon container read-only (`/ssl`), so certificates managed by addons such as Let's Encrypt can be used for MQTT TLS and the frontend [#835](https://github.com/zigbee2mqtt/hassio-zigbee2mqtt/issues/835)
+
 ## 2.14.1-1
 - Updated Zigbee2MQTT to version [`2.14.1`](https://github.com/Koenkk/zigbee2mqtt/releases/tag/2.14.1)
 

zigbee2mqtt/DOCS.md

@@ -70,6 +70,7 @@ If you are interested in adding support for new devices to Zigbee2MQTT see [How
 
 - Depending on your configuration, the MQTT server config may need to include the port, typically `1883` or `8883` for SSL communications. For example, `mqtt://core-mosquitto:1883` for Home Assistant's Mosquitto app.
 - To find out which serial ports you have exposed go to **Settings → System → Hardware → ⋮ → System hardware** and type the device name in the search bar.
+- The Home Assistant `/ssl` directory is mounted read-only, so certificates kept there (for example by the Let's Encrypt addon) can be referenced both in the MQTT configuration (`key: /ssl/privkey.pem`, `cert: /ssl/fullchain.pem`) and in the frontend settings (`ssl_key` / `ssl_cert`). Because it is read-only, renewals performed by the managing addon are picked up without copying files.
 
 # Socat
 

zigbee2mqtt/config.json

@@ -37,6 +37,10 @@
       "type": "addon_config",
       "read_only": false,
       "path": "/addon_config"
+    },
+    {
+      "type": "ssl",
+      "read_only": true
     }
   ],
   "ports": {