I have an ansible role that deploys letsencrypt certificates. It's not perfect, but currently the flow is: check if nginx is running. if it's running, use the webroot authenticator. if it's not, use the standalone authenticator.

This creates issues come renewal time, but a few tweaks to the renewal config (/etc/letsencrypt/renewal/your.domain.conf) fixes that