Activating Let's Encrypt webroot renewal for all my sites.
#!/bin/bash
set -x
# To meet uploading requirements.
apt install rsync
d=welcome
mkdir -p /srv/www/$d
chown user:user /srv/www/$d
cat <<EOF >/etc/apache2/sites-available/$d.conf
<VirtualHost defun.work:*>
DocumentRoot /srv/www/$d
ServerName defun.work
<Directory "/srv/www/$d/">
Require all granted
</Directory>
Alias "/.well-known/acme-challenge/" "/srv/www/letsencrypt/.well-known/acme-challenge/"
<Directory "/srv/www/letsencrypt/">
Require all granted
</Directory>
</VirtualHost>
<IfModule mod_ssl.c>
<VirtualHost defun.work:443>
DocumentRoot /srv/www/$d
ServerName defun.work
<Directory "/srv/www/$d/">
Require all granted
</Directory>
SSLCertificateFile /etc/letsencrypt/live/defun.work/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/defun.work/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>
EOF
a2ensite $d
service apache2 reload