Comment by spindle

I happened to need to do this in NixOS yesterday, and look how easy it is:

  security.acme = {
    acceptTerms = true;
    email = "[email protected]";
    };
   
  services.nginx = {
    enable = true;
    recommendedGzipSettings = true;
    recommendedOptimisation = true;
    recommendedProxySettings = true;
    recommendedTlsSettings = true;
        virtualHosts."whatever.net" = { default = true; enableACME = true; addSSL = true; locations."/".proxyPass = "http://127.0.0.1:9955/"; };
    };

and then each additional proxy takes just one more line. Not quite zero boilerplate, but almost!