Edit nginx.conf and set the servername, this will be the 'origin' defined for the access fabric app. and certbot should find it and request a cert for it. Make sure port 80 is open right now because it's used afor the crt request validation process.
curl -O https://dl.eff.org/certbot-auto
chmod +x certbot-auto
sudo certbot-auto
Edit nginx.conf, and enable auth for your application. It might look something like this in the server section:
auth_accessfabric on;
auth_accessfabric_audience "https://practical-basilisk-3999.accessfabric.com";
The audience is provided to you as part of the application creation in the scaleft gui.