roles/nginx: Switch to acme.sh for Let's Encrypt

The certbot-auto client that I've been using for a long time is now
only supported if you install it using snap. I don't use snap on my
systems so I decided to switch to the acme.sh client, which is imp-
lemented in POSIX shell with no dependencies. One bonus of this is
that I can start using ECC certificates.

This also configures the .well-known directory so we can use webroot
when installing and renewing certificates. I have yet to understand
how the renewal works with regards to webroot, though. I may have to
update the systemd timers to point to /var/lib/letsencrypt/.well-known.

roles/nginx/templates/https.j2

@@ -16,8 +16,8 @@
 
     # concatenated key + cert
     # See: http://nginx.org/en/docs/http/configuring_https_servers.html
-    ssl_certificate {{ letsencrypt_root }}/{{ domain_name }}/fullchain.pem;
-    ssl_certificate_key {{ letsencrypt_root }}/{{ domain_name }}/privkey.pem;
+    ssl_certificate {{ letsencrypt_root }}/certs/{{ domain_name }}.fullchain.pem;
+    ssl_certificate_key {{ letsencrypt_root }}/private/{{ domain_name }}.key.pem;
 
     {% endif %}
 

roles/nginx/templates/renew-letsencrypt.service.j2

@@ -1,7 +1,9 @@
 [Unit]
 Description=Renew Let's Encrypt certificates
-ConditionFileIsExecutable={{ letsencrypt_certbot_dest }}
+ConditionFileIsExecutable={{ letsencrypt_acme_home }}/acme.sh
 
 [Service]
 Type=oneshot
-ExecStart={{ letsencrypt_certbot_dest }} renew --standalone --pre-hook "/bin/systemctl stop nginx" --post-hook "/bin/systemctl start nginx"
+ExecStart={{ letsencrypt_acme_home }}/acme.sh --cron --home {{ letsencrypt_acme_home }} --reloadcmd "/bin/systemctl reload nginx"
+
+SuccessExitStatus=0 2

roles/nginx/templates/vhost.conf.j2

@@ -14,6 +14,8 @@ server {
     listen [::]:80;
     server_name {{ domain_name }} {{ domain_aliases }};
 
+    {% include 'well-known.j2' %}
+
     # redirect http -> https
     location / {
         # ? in rewrite makes sure nginx doesn't append query string again

roles/nginx/templates/well-known.j2

@@ -0,0 +1,6 @@
+location ^~ /.well-known/acme-challenge/ {
+  allow all;
+  root /var/lib/letsencrypt/;
+  default_type "text/plain";
+  try_files $uri =404;
+}