* start letsencrypt's certbot "manually", getting ownership proof data
* write proof into nginx's serving path
* log into the firewall, allow http for the given service
* enable http for the given service
* instruct let's encrypt to check the proof
* get new keys
* disable http for the service
* log into firewall, block http for the given service
* set permissions and ownership on new keys
* perform service specific hooks
	* jellyfin: generating a pkcs12 key

All secrets are GPG encrypted and one password prompt allows for script access to all secrets necessary.

State:

* Only jellyfin is tested and working
* Can only really test when keys come closer to expiring
* code is ugly, could be a nice class or something