Configure Apache with SSL and acme.sh for one or more websites per host, optionally as reverse proxy.

Websites are defined as dict in host_vars / group_vars (or passed via `include_role` vars).
The key is the domain (ServerName and certificate name). Without `websites` the host
serves one website named after `inventory_hostname`.

Before a certificate is requested, a token is placed in `<docroot>/.well-known/acme-challenge/`
and fetched via `http://<domain>/...`. If the domain does not reach this host, certificate
and ssl vhost are skipped (warning at the end of the role) and retried on the next run.

# Example

```yaml
websites:
  example.digital-infinity.de:            # static site
    aliases: www.example.digital-infinity.de
    docroot: /var/www/example
    extra_directives: |
      Header always set Strict-Transport-Security "max-age=31536000"

  app.digital-infinity.de:                # reverse proxy, only the target url is required
    proxy_pass: http://127.0.0.1:8080/

  immich:
    proxy_pass: http://127.0.0.1:2283/
    proxy_websocket: true
    proxy_timeout: 600

  old.digital-infinity.de:
    state: absent                         # removes vhosts and stops renewal, keeps cert files
```

# Options per website

| option | default | |
|---|---|---|
| state | present | `absent` removes the vhosts |
| aliases | [] | ServerAlias, string or list (not part of the certificate) |
| docroot | /var/www/html | also used as acme webroot |
| use_local_ca | `use_local_ca` / false | true -> internal `acme_sh_server` instead of letsencrypt (for internal sites) |
| check_dns | true | reachability check before requesting a certificate |
| extra_directives | "" | raw apache directives inside the ssl vhost |
| proxy_pass | "" | target url, enables the reverse proxy |
| proxy_path | / | |
| proxy_preserve_host | true | ProxyPreserveHost |
| proxy_forwarded_headers | true | X-Forwarded-Proto/-Port |
| proxy_websocket | false | adds `upgrade=websocket` (apache >= 2.4.47) |
| proxy_timeout | "" | `timeout=` in seconds |
| proxy_ssl_verify | true | false disables certificate checks for https backends |
| proxy_options | "" | further ProxyPass options, e.g. `nocanon` |

# Global variables

* `website_check_host` (default `inventory_hostname`): host running the reachability check, e.g. `localhost` to check from the controller
* `website_check_timeout` (default 10)
* `website_fail_without_cert` (default false): fail instead of warn if a domain is not reachable
* `website_site_defaults`: defaults for all websites