hexa: your suggestion was to add this to my security.acme.certs."example.org" configuration, right?

      extraLegoRunFlags = [ "--preferred-chain=\"ISRG Root X1\"" ];
      extraLegoRenewFlags = [ "--preferred-chain=\"ISRG Root X1\"" ];

In reply to @aanderse:nixos.dev
any chance we need to update LEGO? ... or iunno... anything? i think the letsencrypt root cert expired recently and one of my certs is having issues when being used with prosody
i don't have many details, sorry, short on time

In reply to @hexa:lossy.network
some location block shadowing the webroot?

In reply to @hexa:lossy.network
try removing the location blocks one by one to rule them out

For some crazy reason I had

  services.nginx.virtualHosts = {
    "acmechallenge.dodsorf.as" = {
      # Catchall vhost, will redirect users to HTTPS for all vhosts
      serverAliases = [ "*.dodsorf.as" ];
      # /var/lib/acme/.challenges must be writable by the ACME user
      # and readable by the Nginx user.
      # By default, this is the case.
      locations."/.well-known/acme-challenge" = {
        root = "/var/lib/acme/.challenges";
      };
      locations."/" = {
        return = "301 https://$host$request_uri";
      };
    };
  };

in my config