You may be interested in NixOS' way. This is all what you need in your configuration.nix to get a webserver running with an SSL certificate from Let's Encrypt, including automatic refreshes before expired and everything:
services.nginx = {
enable = true;
virtualHosts."example.com" = {
root = "/webroot";
enableACME = true;
};
};