Those lines tell discourse to ignore your proxy servers address and report the address of the actual computer making the request.
The let’s encrypt issue, is because you need not to pass that request to discourse but to the let’s encrypt client that the reverse proxy is running. You could probably add some stuff to tell it to handle that /well-known request itself. Perhaps you’re friends W can help figure that out