nginx ssl, proxy setup

/etc/nginx/sites-enabled/default.conf

server {
	listen 80;
	listen [::]:80;

	root /var/www/html;

	index index.html index.htm index.nginx-debian.html;
    server_name domain.com; # managed by Certbot

	location / {
		proxy_pass http://127.0.0.1:8080;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header Host $host;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	}

    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/domain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/domain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

nginx -t
service nginx restart
nginx -t
service nginx restart
sudo apt install certbot python3-certbot-nginx
sudo ufw allow 'Nginx Full'
sudo ufw delete allow 'Nginx HTTP'

sudo certbot --nginx -d domain.com

or

sudo certbot --nginx -d domain.com -d www.domain.com

crobtab -e
0 12 * * * /usr/bin/certbot renew --quiet

https://github.com/aizwellenstan/nginx-conf
https://ibkr.com/referral/zhenwei375