I think I found the issue, I had this:
after_ssl:
- replace:
filename: "/etc/runit/1.d/letsencrypt"
from: /--keylength/
to: "-d example.com -d www.example.com --keylength"
When I should have had:
after_ssl:
- replace:
filename: "/etc/runit/1.d/letsencrypt"
from: /--keylength/
to: "-d example.com --keylength"
Notice the last line, I had example.com and www.example.com
I also changed return 301 https://$host$request_uri; to return 301 $scheme://$host$request_uri; a rebuild later and it seems to be working.
Now I’m just concerned about what @Stephen mentioned about it breaking when letsencrypt configuration changes..