check this out. i've added on-demand TLS directly to #GitPages, so now to serve pages over TLS all you need* is a single binary and this configuration file:

features = ["acme"]

[acme]
email = "you@example.org"
accept-tos = true

[server]
pages = "tcp/:80"
https = "tcp/:443"

* it's feature-gated for now, until dns-persist-01 becomes stable and we can automatically issue wildcard certificates for wildcard domains as well