ansible-ffibk/roles/service-nginx/templates/letsencrypt-acme-challenge.conf.j2

location ^~ /.well-known/acme-challenge/ {
    resolver 127.0.0.1;
    set $acme_host {{ acme_server }}.{{ http_domain_internal }};
    proxy_pass https://$acme_host:443;
}

location = /.well-known/acme-challenge/ {
    return 404;
}