Trust Proxy Headers

ssh root@your-server-ip

apt update
apt install certbot python3-certbot-nginx
# Or for standalone:
apt install certbot

nano /etc/nginx/sites-available/myapp
# server {
#     listen 80;
#     server_name myapp.com www.myapp.com;
#     location / {
#         proxy_pass http://localhost:3000;
#         proxy_http_version 1.1;
#         proxy_set_header Upgrade $http_upgrade;
#         proxy_set_header Connection 'upgrade';
#         proxy_set_header Host $host;
#         proxy_cache_bypass $http_upgrade;
#     }
# }

ln -s /etc/nginx/sites-available/myapp /etc/nginx/sites-enabled/
nginx -t
systemctl reload nginx

certbot --nginx -d myapp.com -d www.myapp.com
# Answer the interactive prompts
# Wait for DNS verification
# Hope it doesn't fail

# Test renewal
certbot renew --dry-run

# Add cron job
crontab -e
# 0 12 * * * /usr/bin/certbot renew --quiet