deploying-wpa-eap-ttls-pap

I would like to point out that when following the guide below, freeradius cannot read the private key because it does not have the correct permissions.
The task only creates the archive folder without copying the certificates.
https://openwisp.io/docs/stable/ansible/user/deploying-wpa-eap-ttls-pap.html#

controller.nnxx.ninux.org freeradius[6994]: tls: (TLS) Failed reading private key file "/etc/letsencrypt/live/nnxx.ninux.org/privkey.pem"
controller.nnxx.ninux.org freeradius[6994]: tls: (TLS) error:8000000D:system library::Permission denied
controller.nnxx.ninux.org freeradius[6994]: tls: (TLS) error:10080002:BIO routines::system lib
controller.nnxx.ninux.org freeradius[6994]: tls: (TLS) error:0A080002:SSL routines::system lib
controller.nnxx.ninux.org freeradius[6994]: rlm_eap_ttls: Failed initializing SSL context
controller.nnxx.ninux.org freeradius[6994]: rlm_eap (default_eap): Failed to initialise rlm_eap_ttls
controller.nnxx.ninux.org freeradius[6994]: /etc/freeradius/3.0/mods-enabled/default_eap[1]: Instantiation failed for module "default_eap"
controller.nnxx.ninux.org systemd[1]: freeradius.service: Control process exited, code=exited, status=1/FAILURE

root@controller:nnxx.ninux.org # ll
totale 28K
drwxr-xr-x 2 root freerad 4,0K 30 nov 22.26 .
drwxr-x--- 3 root freerad 4,0K 30 nov 22.12 ..
-rw-r--r-- 1 root freerad 1,3K 30 nov 22.26 cert.pem
-rw-r--r-- 1 root freerad 1,6K 30 nov 22.26 chain.pem
-rw-r--r-- 1 root freerad 2,8K 30 nov 22.26 fullchain.pem
-rw------- 1 root freerad  241 30 nov 22.26 privkey.pem
-rw-r--r-- 1 root freerad  692 30 nov 22.26 README

Perhaps something like this could work:
rsync -rtlv --chown=freerad:freerad --chmod=D750,F640 /etc/letsencrypt/live/nnxx.ninux.org /etc/freeradius/3.0/SSL
To run when certificates are renewed

Start with the Ansible deployment task linked from the WPA-EAP-TTLS-PAP guide and trace how the certificate archive is created and handled during renewal. Verify the deployment copies the certificates with permissions that let FreeRADIUS read the private key, then confirm the service starts successfully after renewal.