So here's what I did:

Starting with the standard config (A), I ran the following:

I followed this guide: https://www.nginx.com/blog/using-free-ssltls-certificates-from-lets-encrypt-with-nginx/

sudo apt-get install certbot
sudo apt-get install python3-certbot-nginx

Let that install, and then

sudo certbot --nginx -d trog.co.za

That changed my proxy.conf file to look like config (B). Which doesn't work. If I type ombi.trog.co.za I get a 404, and if I add https I get "ERR_SSL_PROTOCOL_ERROR".


So I asked around and did some reading and tried the following:

I removed the certbot I got from apt-get and instead followed the actual instructions for Certbot from https://certbot.eff.org/instructions?ws=nginx&os=ubuntufocal.

So I ran:

sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot
sudo snap set certbot trust-plugin-with-root=ok
sudo snap install certbot-dns-gandi (This didn't work)

So then
pip install certbot-plugin-gandi (From https://github.com/obynio/certbot-plugin-gandi)
I followed the rest of the instructions from that github page: Create gandi.ini, add API key from gandi, sudo chmod 600 gandi.ini.

I then ran
certbot certonly --authenticator dns-gandi --dns-gandi-credentials /etc/letsencrypt/gandi/gandi.ini -d trog.co.za

Only to realise I should probably have done the wildcard version cuz I'm stupid and didn't read it the first time. So I ran this

certbot certonly --authenticator dns-gandi --dns-gandi-credentials /etc/letsencrypt/gandi/gandi.ini -d domain.com -d \*.domain.com --server https://acme-v02.api.letsencrypt.org/directory

This was apparently successful, but it still doesn't work. It creates keys in the same place as the apt-get version does, so I kept config (B) and restarted nginx and fuckall.

Then I asked for help from someone else, and got config (C). This config redirects HTTP to https, which is great. But still ends up with "ERR_SSL_PROTOCOL_ERROR" for me, but "SSL_ERROR_RX_RECORD_TOO_LONG" for him for some reason.


Thanks for coming to my TED Talk.
************************************************************************************
Config A:

server {
# The IP that you forwarded in your router (nginx proxy)
  listen 80;

# Make site accessible from http://localhost/
 server_name trog.co.za;

# The internal IP of the VM that hosts your Apache config
 set $upstream 192.168.0.203:5000;

 location / {

 proxy_pass_header Authorization;
 proxy_pass http://$upstream;
 proxy_set_header Host $host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_http_version 1.1;
 proxy_set_header Connection "";
 proxy_buffering off;
 client_max_body_size 0;
 proxy_read_timeout 36000s;
 proxy_redirect off;

 }
}

************************************************************************************
Config B:

server {
# The IP that you forwarded in your router (nginx proxy)

# Make site accessible from http://localhost/
 server_name trog.co.za;

# The internal IP of the VM that hosts your Apache config
 set $upstream 192.168.0.203:5000;

 location / {

 proxy_pass_header Authorization;
 proxy_pass http://$upstream;
 proxy_set_header Host $host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_http_version 1.1;
 proxy_set_header Connection "";
 proxy_buffering off;
 client_max_body_size 0;
 proxy_read_timeout 36000s;
 proxy_redirect off;

 }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/trog.co.za/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/trog.co.za/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
server {
    if ($host = trog.co.za) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


  listen 80;
 server_name trog.co.za;
    return 404; # managed by Certbot


}

************************************************************************************
Config C:

server {
    listen 80;
    server_name ombi.trog.co.za;
    return 301 https://$server_name$request_uri;
}

server {
  listen  443 ssl;
  server_name ombi.trog.co.za;
  ssl_certificate /etc/letsencrypt/live/trog.co.za/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/trog.co.za/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

# The IP that you forwarded in your router (nginx proxy)

# Make site accessible from http://localhost/
# server_name trog.co.za;

# The internal IP of the VM that hosts your Apache config
 set $upstream 192.168.0.203:5000;

  location / {

     proxy_pass_header Authorization;
     proxy_pass http://$upstream;
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_http_version 1.1;
     proxy_set_header Connection "";
     proxy_buffering off;
     client_max_body_size 0;
     proxy_read_timeout 36000s;
     proxy_redirect off;
  }
}
************************************************************************************