# HTTPS: create Diffie-Hellman keys
openssl dhparam -dsaparam -out /etc/nginx/dhparam.pem 4096

# HTTPS: create ACME-challenge common directory
sudo -u {{ data.user }} sh -c "mkdir -p /var/www/_letsencrypt"

# HTTPS: certbot (obtain certificates)
certbot certonly --webroot --webroot-path /var/www/_letsencrypt --email {{ data.email }} --domain {{ data.domain }} --domain www.{{ data.domain }} --domain cdn.{{ data.domain }} --text --non-interactive --agree-tos --force-renew