I'm using Ansible to manage NGINX server configurations, i.e., my playbooks contain some roles that roll out NGINX server config templates.
This is my first contact with the topic SSL and I've been told Certbot is the easiest way to integrate letsencrypt certificates. As a first test I did run Certbot manually on a server. It worked in the sense that I got SSL to work. However, I noticed that Certbot manually patched the NGINX configs, and after re-applying the Ansible deployment it reverted Certbot's changes, breaking SSL again, because Ansible assumes full control over the configs.
I'm wondering what are possible strategies to integrate Certbot in an automated way. Should I apply the patching mechanism of Certbot on every deploy, or is it better to use Certbot in the
certonly mode, so that it doesn't mess with the NGINX config. What are pros/cons of these solutions?
Note: I've seen this related question and the ansible-role-certbot plugin, but they don't directly touch on the topic of maintaining NGINX configurations, and I still have trouble thinking this through.