Your stance rules out all the big and mature software. No judgement on the stance, but you are asking a difficult question.

Off that alternatives list, the only one I’ve heard of is lighttpd, and it’s news to me that lighty can do reverse proxying. But I would try that.

I expect it to be a lot more difficult to find documentation and support for anything more obscure than lighty. Which may be fine for you, just know what you’re getting in to.

As for certbot, iirc you need to add a renew command to cron, but otherwise certbot will take care of it. I’m sure the cron is in the documentation.

Note that sudo echo does not work as non root because the shell redirection is attempted before the command runs. You want echo foo | sudo tee -a /bar instead