nginx-config für reverse-proxy mit http innen, https außen.

cert_new

#!/bin/bash

ufw disable
certbot --expand -n --nginx --domains <dns_a_name>,<dns_cname_1>,<dns_cname_2>,[...]
ufw enable

default

[...]

server{
	listen 80;
#	listen [::]:80; // if IPv6 enabled.
	server_name <external_dns_cname>;
	return 301 https://$host$request_uri;
}

// [...]

server {
	listen 443 ssl;
#	listen [::]:443 ssl; // if IPv6 enabled.

	server_name <external_dns_cname>;

	location / {
		proxy_pass http://<internal_ip_[:<port>]>/;
	}
    ssl_certificate /etc/letsencrypt/live/<dns_name_of_hostsystem_with_certbot>/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/<dns_name_of_hostsystem_with_certbot>/privkey.pem; # managed by Certbot
}