* start letsencrypt's certbot "manually", getting ownership proof data
* write proof into nginx's serving path
* log into the firewall, allow http for the given service
* enable http for the given service
* instruct let's encrypt to check the proof
* get new keys
* disable http for the service
* log into firewall, block http for the given service
* set permissions and ownership on new keys
* perform service specific hooks
	* jellyfin/plex: generate a pkcs12 key and
	                 put it in the right place

All secrets are GPG encrypted and one password prompt allows for script access to all secrets necessary.

State:

* running for all services, no known bugs at this time