Update on this. Thanks everybody for your suggestions. The core problems (except for one) have apparently (more testing to do) been resolved. The obvious one remaining is that ssl certs are no longer renewing, and even the manual renew process recommended here doesn’t work. It appears that Let’s Encrypt is unable to access the validation file here from the “well known” directory. This had been working fine for almost 3 years previously. So this is still a problem, especially since HSTS blocks Chrome entirely in this situation.