On EC2 I put Certbot renew on a timer and run nginx -t before reloading. I also pin the proxy_pass upstream by private IP or docker network name so a container recreate does not leave nginx pointing at a dead address until the next restart.