title: What is the proper way to script a new nginx instance with SSL on a new Ubuntu 16.04 server?
body: <p>I have this so far but I'm missing a couple of things like getting the cron job scripted. Don't want to do this as root. So I'm assuming some more could be done to set up the first user at the same time. The script would need to be idempotent (can be run over and over again without risking changing anything if it was run with the same arguments before).</p>
  
  <p>singledomaincertnginx.sh:</p>
  
  <pre><code>#!/bin/bash
  if [ -z "$3" ]; then
          echo use is "singledomaincertnginx.sh &lt;server-ssh-address&gt; &lt;ssl-admin-email&gt; &lt;ssl-domain&gt;"
          echo example: "singledomaincertnginx.sh user@mydomain.com admin@mydomain.com some-sub-domain.mydomain.com"
          exit
  fi
  ssh $1 "cat &gt; ~/wks" &lt;&lt; 'EOF'
  #!/bin/bash
  echo email: $1
  echo domain: $2
  sudo add-apt-repository -y ppa:certbot/certbot
  sudo apt-get update
  sudo apt-get upgrade -y
  sudo apt-get install -y software-properties-common
  sudo apt-get install -y python-certbot-nginx
  sudo apt-get install -y nginx
  sudo sed -i "s/server_name .*;/server_name $2;/" /etc/nginx/sites-available/default
  sudo systemctl restart nginx.service
  if [[ -e /etc/letsencrypt/live/$2/fullchain.pem ]]; then
    sudo certbot -n --nginx --agree-tos -m "$1" -d "$2"
  fi
  if [[ ! sudo crontab -l | grep certbot ]]; then
    # todo: add cron job to renew: 15 3 * * * /usr/bin/certbot renew --quiet
  EOF
  ssh $1 "chmod +x ~/wks"
  ssh -t $1 "bash -x -e ~/wks $2 $3"
  </code></pre>