oh just checked that certbot has updated their instructions for nginx. Taking that back.