The cleanest way to build it, which has potential to be something we eventually ship would be adding a new template that would be an alternative to web.ssl.template.yml, let’s call it web.ssl2.template.yml.
In this template, instead of modifying nginx, it starts an alternative web server, let’s say Caddy, which handles all the traffic and proxies to the nginx. This would allow a lot of experimentation, ability to test multiple web servers, and can potentially evolve into something we could make a default for new installs.