certbot and nginx working

ansible/roles/nginx/templates/nginx.conf.j2

@@ -0,0 +1,48 @@
+user {{ nginx_user }};
+worker_processes auto;
+worker_cpu_affinity auto;
+
+# include extra config
+include /etc/nginx/conf.d/*.conf;
+
+events {
+    multi_accept on;
+    worker_connections 1024;
+}
+
+http {
+    charset utf-8;
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    server_tokens off;
+    log_not_found off;
+    types_hash_max_size 4096;
+    client_max_body_size 16M;
+
+    # MIME
+    include mime.types;
+    default_type application/octet-stream;
+
+    # Include SSL config
+    include ssl/ssl.conf;
+
+    server {
+        listen 80 default_server;
+        server_name "_";
+        return 444;
+    }
+
+    server {
+        listen 443 ssl http2 default_server;
+        server_name "_";
+        ssl_reject_handshake on;
+    }
+
+    # logging
+    access_log /var/log/nginx/access.log;
+    error_log /var/log/nginx/error.log warn;
+
+    # include sites
+    include /etc/nginx/sites-enabled/*.conf;
+}

ansible/roles/nginx/templates/site.conf.j2

@@ -0,0 +1,17 @@
+server {
+    listen 80;
+    server_name {{ item.name }};
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    server_name {{ item.name }};
+    ssl_certificate     /etc/letsencrypt/live/{{ item.name }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ item.name }}/privkey.pem;
+    location / {
+        proxy_pass http://{{ item.upstream.host }}:{{ item.upstream.port }};
+    }
+}