What an ugly workaround that only makes sense on unconfigurable 20 century distros. =/ services.nginx.virtualHosts.<name>.enableACME just works and uses a similarly fine-tested solution without the need to needlessly combining loosely coupled software