Letsencrypt: webroot or standalone for node.js app?

Question

Nginx

It is not entirely clear how the certificate and domain will be verified for an application on node.js?
In all examples, some /.well-known/acme-challenge/ folders. What are these folders, where are they and why? are they needed if the application is on node.js? Where to place them - inside the structure of my project, or what? "acme-challenge" - what is it anyway? I suck at these instructions.
Which way to choose webroot or standalone? Given that I want to run multiple sites with different domains on the same VPS. Ubuntu 16.04.

Answer 1

I wrote a couple of scripts for myself:

#!/bin/bash

# Usage:
# sudo ~/letsencrypt/addnew.sh domain.ru

set -e

DOMAIN="$1"

sudo letsencrypt certonly -a webroot --webroot-path=/var/www/html -d ${DOMAIN} -d www.${DOMAIN}
#openssl dhparam -out /etc/pki/nginx/dhparam.pem 4096

echo -e '
*********************************************************************
NGINX config add:
    ssl_certificate /etc/letsencrypt/live/${DOMAIN}/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/${DOMAIN}/privkey.pem;
    ssl_dhparam /etc/pki/nginx/dhparam.pem;
*********************************************************************
'

#!/bin/bash

# This script renews all the Let's Encrypt certificates with a validity < 30 days
# Usage:
#   run command:
#       sudo crontab -e
#   add string
#       @daily /home/vpsuser/letsencrypt/letsencrypt.cron.sh
#   run command:
#       chmod +x /home/vpsuser/letsencrypt/letsencrypt.cron.sh

NGINX=$(which nginx)

if ! /usr/bin/letsencrypt renew > /var/log/letsencrypt/renew.log 2>&1 ; then
    echo Automated renewal failed:
    cat /var/log/letsencrypt/renew.log
    exit 1
fi
${NGINX} -t && service nginx restart

Well, Nginx:

server {
  listen 80 default_server;
  listen [::]:80 default_server;

  root /var/www/html;
  index index.html index.htm index.php;
  server_name _;

  location / {
    try_files $uri $uri/ =404;
  }

  # For LetsEncrypt: https://letsecure.me/secure-web-deployment-with-lets-encrypt-and-nginx/
  location ~ /.well-known/acme-challenge {
    allow all;
  }
}

Well, documentation:
https://gist.github.com/yarkovaleksei/2c6c96222924...