hooks-letsencrypt.conf

location /.well-known/acme-challenge/ {
    alias /var/www/challenges/.well-known/acme-challenge/;
    try_files $uri @forward_https;
}
location @forward_https {
    return 301   https://$host$request_uri;
}
location / {
    return 301   https://$host$request_uri;
}

sites_enabled-server.conf

server {
        server_name server.tld;
        listen [::]:80;

        include hooks/letsencrypt.conf;
}
server {
        server_name server.tld;

        listen [::]:443 ssl; # http2

        ssl on;
        ssl_certificate /etc/letsencrypt/live/server.tld/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/server.tld/privkey.pem;
}