Finally got this into a nice enough state to show to the critics (you).

For future reference I'll document how I setup a free letsencrypt ssl cert with autorenewal for the site using certbot and lighttpd with the mod_proxy module.