roles/quassel: Write the cert somewhere quassel can read it

roles/quassel/templates/letsencrypt.hook.d.j2

@@ -2,9 +2,13 @@
 
 test "$1" = renew || exit 0
 
+quassel_domain="{{ quassel_domain }}"
+
 for domain in $RENEWED_DOMAINS; do
   case "$domain" in
-    {{ quassel_domain }})
+    $quassel_domain)
+      cat /etc/letsencrypt/live/$quassel_domain/{privkey,fullchain}.pem |
+        install -o quassel -g quassel -m 400 /dev/stdin /var/lib/quassel/quasselCert.pem
       systemctl restart quassel
       ;;
   esac

roles/quassel/templates/quassel.service.d.j2

 [Service]
 ExecStartPre=/usr/bin/truncate -s 0 /var/lib/quassel/.oidentd.conf
 ExecStart=
-ExecStart=/usr/bin/quasselcore --configdir=/var/lib/quassel --oidentd --syslog --require-ssl \
-    --ssl-cert=/etc/letsencrypt/live/{{ quassel_domain }}/fullchain.pem \
-    --ssl-key=/etc/letsencrypt/live/{{ quassel_domain }}/privkey.pem
+ExecStart=/usr/bin/quasselcore --configdir=/var/lib/quassel --oidentd --syslog --require-ssl