Lately I've just been throwing everything behind Caddy (caddyserver.com) in reverse proxy mode. This is all you need in your Caddyfile to get automatic TLS. It's genius.

<hostname> { tls <your email> proxy / localhost:<port> }