fix(nginx): make Let's Encrypt opt-in per service

certbot cannot issue for internal hostnames (*.nas.local), which made
nginx-enabled services with internal names fail on deploy.

Add a <service>_nginx_letsencrypt flag (default false) and computed
<service>_nginx_ssl_certificate/_key paths: when off the vhost uses the
shared self-signed cert (nginx_default_ssl_cert), when on it uses the
Let's Encrypt lineage. Gate the certbot include on the flag and apply the
pattern to all service roles (deluge, fdroid, gitea, grafana, immich,
metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).

roles/deluge/tasks/main.yml

@@ -83,11 +83,27 @@
   become: false
   become_user: "{{ ansible_user }}"
 
+- name: Allow torrent traffic through firewall
+  community.general.ufw:
+    rule: allow
+    port: "{{ deluge_torrent_port }}"
+    proto: any
+    from: "{{ item }}"
+    direction: in
+    comment: "Deluge torrent"
+  loop: "{{ deluge_firewall_allowed_sources }}"
+  loop_control:
+    label: "{{ item }}"
+  retries: 5
+  delay: 2
+  register: _deluge_ufw
+  until: _deluge_ufw is succeeded
+
 - name: Provision TLS certificate for Deluge
   ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
   vars:
     certbot_hostname: "{{ deluge_nginx_hostname }}"
-  when: deluge_nginx_enabled
+  when: deluge_nginx_enabled and deluge_nginx_letsencrypt
 
 - name: Deploy nginx vhost configuration for Deluge
   ansible.builtin.template: