Lately I've just been throwing everything behind Caddy (caddyserver.com) in reverse proxy mode. This is all you need in your Caddyfile to get automatic TLS. It's genius.
Wow, this might actually be good enough / full-featured enough to let me stop copying around my huge HAproxy configuration boilerplate and Ansible roles for every project I spin up. Very cool!
<hostname> { tls <your email> proxy / localhost:<port> }