I was a bit worried too about exposing the docker socket, even to a well trusted image and even if it seems it'a a widely adopted practice for such automatic configurations.

Fortunately ducaale suggested https://hub.docker.com/r/steveltn/https-portal/.

I adapted the site and will publish a follow-up about using this image for nginx - let's encrypt configuration.