Or certbot-plugin-nginx if you prefer a bit less magic.