One nginx server on host machine with renewable certificate (via certbot). And another nginx server inside docker container. First one should redirect all traffic to the second one.
Currently I have one nginx service inside container and I connect certificates that stored on host to that server via volumes. But with this kind of setup I can't renew certificates automatically...
Sure, you put in as many proxies as you need. You don't want to over-complicate things, but it seems you have a good reason for your architecture.
Production configurations often involve multiple levels of proxies. Each should provide a place for gathering stats. Proxies can also hide backend failures if you have a pool of nodes behind the proxy, which doesn't seem to be what you're going for here.
Your comment that you wouldn't be able to renew certificates with extra proxies is not correct. You can update certs via DNS auth then deploy to your proxies through whatever mechanism you're already happy with.
