bundles/letsencrypt: remove ocsp stapling

This causes problems with weechat and dovecot. Those certificates
are short-lived, so not having OCSP stapling is probably fine.

bundles/letsencrypt/files/config

@@ -3,5 +3,3 @@ BASEDIR=/var/lib/dehydrated
 WELLKNOWN="${BASEDIR}/acme-challenges"
 DOMAINS_TXT="/etc/dehydrated/domains.txt"
 HOOK="/etc/dehydrated/hook.sh"
-OCSP_MUST_STAPLE="yes"
-OCSP_FETCH="yes"

bundles/letsencrypt/items.py

@@ -11,6 +11,9 @@ actions = {
         'needs': {
             'pkg_apt:dehydrated',
         },
+        'needed_by': {
+            'svc_systemd:nginx',
+        },
     },
 }
 
@@ -21,7 +24,11 @@ files = {
             'action:letsencrypt_update_certificates',
         },
     },
-    '/etc/dehydrated/config': {},
+    '/etc/dehydrated/config': {
+        'triggers': {
+            'action:letsencrypt_update_certificates',
+        },
+    },
     '/etc/dehydrated/hook.sh': {
         'content_type': 'mako',
         'mode': '0755',