blugh, never fixed the issue where certbot renewal doesn't reload nginx, and both my masto instance and relay.gay have had an invalid cert for weeks bc I'm never on fedi these days to notice