HAProxy with a bundled Certbot (Let's Encrypt support). More or less a vanilla install with automatic reloads.
Install it and edit haproxy.cfg. HAProxy will be reloaded automatically if the file is valid. Certificates are managed with "snap set passprox ...".
For more information see https://github.com/nsg/passprox