inserted 'fqdn' variable so use of inventory hostname as a fully qualified domain name for managed node or target host services could be overridden

roles/init-server/templates/user/certbot.env.j2

@@ -1,6 +1,6 @@
 CERTBOT_EMAIL="{{ certbot.email }}"
 CERTBOT_AUTHENTICATOR={{ certbot.auth_method }}
-SERVER_WEBROOT_PATH={{ ansible_user_home.stdout + "/srv/acme." + inventory_hostname }}
+SERVER_WEBROOT_PATH={{ ansible_user_home.stdout + "/srv/certbot." + (fqdn | default(inventory_hostname)) }}
 {% if compose.mode == "dev" %}
 # @TODO find a better way to have processed the below in Ansible
 CERTBOT_CHALLENGE_DOMAINS={{ certbot.domains | map("regex_replace", "\\.([^\\.]*)$", ".test") | list | join(",") }}

roles/init-server/templates/user/config/caddy/Caddyfile.j2

@@ -1,11 +1,27 @@
-http://<< inventory_hostname >> {
-	handle /.well-known/acme-challenge/* {
-		reverse_proxy localhost:80
-	}
+http://<< web_fqdn >> {
+  handle /.well-known/acme-challenge/* {
+    reverse_proxy localhost:80
+  }
+  handle {
+    redir https://{host}{uri} 308
+  }
 }
-
 :80 {
-	root * /srv/<< inventory_hostname >>
-	file_server
-	encode gzip
+  root /srv/certbot.<< web_fqdn >>
+  browse
+}
+<< web_fqdn >> {
+  respond 503
+  # root /srv/<< web_fqdn >>
+  file_server
+  
+  header /.well-known/openpgpkey/* {
+    Content-Type application/octet-stream
+    Access-Control-Allow-Origin *
+  }
+  
+  handle_errors {
+    rewrite /error/{err.status_code}.html
+    templates
+  }
 }