nginx.conf https only with letsencrypt using lego client

example.com.conf

# /etc/nginx/sites-enabled/example.com.conf
server {
  listen 80;
  server_name .example.com;
  root /var/letsencrypt/webcache;
  location /.well-known {
    try_files $uri =404;
  }
  location / {
    return 301 https://$host$request_uri;
  }
}

server {
  listen 443 ssl;
  server_name .example.com;

  ssl_certificate /var/letsencrypt/certificates/example.com.crt;
  ssl_certificate_key /var/letsencrypt/certificates/example.com.key;

  location / {
    proxy_set_header  X-Real-IP        $remote_addr;
    proxy_set_header  X-Forwarded-For  $proxy_add_x_forwarded_for;
    proxy_set_header  Host             $http_host;

    proxy_pass http://internal-content-host;
   }
}

letsencrypt

# one time setup
$ go get -u github.com/xenolf/lego
$ lego --email letsencrypt@example.com --domains example.com --path /var/letsencrypt --webroot /var/letsencrypt/webcache run

# renew (can be run from cron)
$ lego --email letsencrypt@example.com --domains example.com --path /var/letsencrypt --webroot /var/letsencrypt/webcache renew