feat: certbot reorg

- moved certbot into its own module
- added fact to list available certificates
- created systemd timer to rsync data to $data_dir/pub
- ensure the $data_dir/pub exists
- manage selinux for nginx

hieradata/country/au/region/syd1.yaml

@@ -1,3 +1,3 @@
 ---
 timezone::timezone: 'Australia/Sydney'
-profiles::pki::letsencrypt: ausyd1nxvm1021.main.unkin.net
+certbot::client::webserver: ausyd1nxvm1021.main.unkin.net

hieradata/country/au/region/syd1/infra/halb/haproxy.yaml

@@ -201,3 +201,14 @@ profiles::pki::vault::alt_names:
 profiles::haproxy::dns::cnames:
   - au-syd1-pve.main.unkin.net
   - au-syd1-pve-api.main.unkin.net
+
+# letsencrypt certificates
+certbot::client::domains:
+  - au-syd1-pve.main.unkin.net
+  - au-syd1-pve-api.main.unkin.net
+  - sonarr.main.unkin.net
+  - radarr.main.unkin.net
+  - lidarr.main.unkin.net
+  - readarr.main.unkin.net
+  - prowlarr.main.unkin.net
+  - fafflix.unkin.net