Solid writeup and impressive experience. You can try Caddy instead of nginx. Automatic HTTPS, dead-simple config, and it proxies to your Go binary in about 4 lines. If you're still manually managing Let's Encrypt certs in 2026, stop. Caddyfile for a Go backend is literally: reverse_proxy localhost:8080 — that's the whole thing.