Let's Encrypt Certificate improvements

I don't think you understand how Nginx works or what it is maybe?

so its like this I run a PC server it has a web server on port 443 for HTTPS and port 8080 for HTTP I also have a DNS-over-HTTPS with a Let's Encrypt then have nginx on where the web server is thats on port 80 the config (the important bits) is like this:

}
server {
listen 80;
server_name server.bridgemode.network;
location / {
proxy_pass http://localhost:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
server {
listen 80;
server_name dns.bridgemode.network;
location / {
proxy_pass http://192.168.138.13:80;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}

So anything server.bridgemode.network goes to the web server on port 8080 and anything dns.bridgemode.network goes to the DNS-over-HTTPS server when certbot does setup or renew incoming traffic to port 80 that how the Certificate challenge is done will be for dns.bridgemode.network

as Nginx is a proxy traffic will be like this

source IP > WAN IP:80 >Nginx> 192.168.138.2 > 192.168.138.13:80 to DNS-over-HTTPS server when it opens port 80 for challenge 

so what I would do is add to the above setup like

server {
listen 80;
server_name zyxel-router1.bridgemode.network;
location / {
proxy_pass http://192.168.138.100:88;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

so

source IP > WAN IP:80 >Nginx> 192.168.138.2 > 192.168.138.100:88 to USG

the reason to change port to like 88 is the UI thats on 80 for the USG I don't think the Certificate challenge will know that Nginx changed the port as returning traffic will come from source 80 by Nginx.