On a single droplet I terminate TLS at nginx and leave the app on localhost only. After Certbot writes the cert paths, nginx -t then reload; if renew fails, check that /.well-known/acme-challenge is not proxied to the app.