make Certbot/Let's Encrypt certificates available to other tools

_.sh

#!/bin/bash

set -e
set -o pipefail

# install & configure Certbot…

# make /etc/letsencrypt accessible to ssl-cert group
chgrp -R ssl-cert /etc/letsencrypt
find /etc/letsencrypt -exec chmod g+r "{}" \;
find /etc/letsencrypt -type d -exec chmod g+x "{}" \;

# allow CoreDNS user to read /etc/letsencrypt
usermod -G ssl-cert coredns