Just do Caddy instead of nginx/cerbot all that garbage. Caddy just simply handles it all for you: Subdomains, wildcard certs, authentication, ssl

My whole caddy config file is like 6 lines; something like

@mydomain.com {

ipaddress:port

path:/

}

And you can do all sorts of plugins that make it compatible with fail2ban, etc.

I hear Traefik is pretty easy to set up too.