feat: move acme certificate automation into a plugin (C7)

docker/nginx-https.conf

@@ -74,7 +74,18 @@ http {
         listen ${PORT};
         server_name _;
 
-        return 301 https://$host:${SSL_PORT}$request_uri;
+        # ACME http-01 checks arrive on plain HTTP and must not be redirected.
+        location ^~ /.well-known/acme-challenge/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        }
+
+        location / {
+            return 301 https://$host:${SSL_PORT}$request_uri;
+        }
     }
     # END HTTP_REDIRECT_SERVER
 
@@ -92,9 +103,11 @@ http {
         add_header X-Content-Type-Options nosniff always;
 
         location ^~ /.well-known/acme-challenge/ {
-            root /app/data/acme-webroot;
-            default_type "text/plain";
-            try_files $uri =404;
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         }
 
         location = /sw.js {