nginx.conf

    server {
    listen      80;
    listen [::]:80;
    server_name SERVERNAME;

    location / {
        rewrite ^ https://$host$request_uri? permanent;
    }

    location ~ /.well-known/acme-challenge {
        allow all;
        root /data/letsencrypt;
    }
}

## server {
##     listen 443 ssl http2;
##     listen [::]:443 ssl http2;
##     server_name SERVERNAME
##
##     server_tokens off;
##
##     ssl_certificate      /etc/letsencrypt/live/SERVERNAME/fullchain.pem;
##     ssl_certificate_key  /etc/letsencrypt/live/SERVERNAME/privkey.pem;
##
##     ssl_buffer_size 8k;
##
##     ssl_dhparam /etc/ssl/certs/nginx/dh2048.pem;
##
##     ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
##     ssl_prefer_server_ciphers on;
##
##     ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
##
##     ssl_ecdh_curve secp384r1;
##     ssl_session_tickets off;
##
##     # OCSP stapling
##     ssl_stapling on;
##     ssl_stapling_verify on;
##     resolver 8.8.8.8;
##
##     location ~ /.well-known/acme-challenge {
##         allow all;
##         root /data/letsencrypt;
##     }
##
##     location / {
##         proxy_pass http://HOSTIP:DESTPORT;
##         proxy_set_header Host $host;
##         proxy_set_header X-Real-IP $remote_addr;
##         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
##         proxy_set_header X-Forwarded-Proto https;
##     }
## }