Automatic renewal

Let's Encrypt certificates expire after 90 days. Add a cron job to the root
crontab on the box to renew automatically:

sudo crontab -e

Add this line (adjust <dns> to your hostname):

0 3 * * * certbot renew --post-hook 'cp /etc/letsencrypt/live/<dns>/fullchain.pem /var/lib/quantum-controller/tls/webui-cert.pem && cp /etc/letsencrypt/live/<dns>/privkey.pem /var/lib/quantum-controller/tls/webui-key.pem'

This runs at 3 AM every day. Certbot only contacts Let's Encrypt when the
certificate is within 30 days of expiry, so daily invocations are harmless.
The --post-hook copies the renewed files into the location gunicorn reads,
which triggers an in-place reload.

To test that the renewal command works without actually contacting Let's Encrypt:

sudo certbot renew --dry-run