** Using WeBWorK **

Yeah, there was one other thread about it in 2020, but it petered out without a resolution:

https://webwork.maa.org/moodle/mod/forum/discuss.php?d=4958

There is only one modification, a cherry-picked change from a later branch to allow Certbot to request certificates:

ubuntu@ip-172-31-45-160:/opt/webwork/webwork2$ git status
On branch main
Your branch is up to date with 'origin/main'.
Changes not staged for commit:
  (use "git add <file>..." to update what will be committed)
  (use "git restore <file>..." to discard changes in working directory)
	modified:   lib/Mojolicious/WeBWorK.pm
no changes added to commit (use "git add" and/or "git commit -a")
ubuntu@ip-172-31-45-160:/opt/webwork/webwork2$ git diff
diff --git a/lib/Mojolicious/WeBWorK.pm b/lib/Mojolicious/WeBWorK.pm
index 5d5441286..bb5effc8b 100644
--- a/lib/Mojolicious/WeBWorK.pm
+++ b/lib/Mojolicious/WeBWorK.pm
@@ -240,6 +240,16 @@ sub startup ($app) {
                                        . 'It must consist entirely of digits.  SOAP endpoints NOT enabled.');
                }
        }
+       # Letsencrypt renewal route. Cherrypicked from https://github.com/openwebwork/webwork2/pull/2321/commits/2bd380a5906ac63537612acc2bfa78268312f240
+       if ($config->{enable_certbot_webroot_routes}) {
+               $r->any(
+                       "/.well-known/*static" => sub ($c) {
+                               my $file = "$ce->{webworkDirs}{tmp}/.well-known/" . $c->stash('static');
+                               return $c->reply->file($file) if -r $file;
+                               return $c->render(data => 'File not found', status => 404);
+                       }
+               );
+       }
        # Note that these routes must come last to support the case that $webwork_url is '/'.

There's no load balancer. I'm serving it directly via hypnotoad/mojolicious, as described in the setup instructions. We've never used a proxy or load balancer; before this version we served webwork via apache24 and mod_perl.