salt/base/nginx/files/include/certbot.conf

{% import 'globals.jinja' as globals %}
location /.well-known/ {
    # The trailing '/.well-known/' is important as it causes nginx to send the
    # cleaned URI through to the destination service (double slashes
    # removed, etc.).
    proxy_pass http://{{ globals.certbot_proxy_ip_address }}/.well-known/;
    proxy_set_header Host {{ globals.certbot_proxy_host }};
}