Succesfully ran Certbot. Site still not secure. What did I do wrong? - express

Question

I have a Digital Ocean VM running an Express backend server listening to port 5000.
I have all these records setup to point my VM ip to the domain I registered.
https://i.imgur.com/dfdBgKb.jpg
I have Nginx installed and a sites-available/sites-enabled config file like this:
https://i.imgur.com/TxMtfSM.png
/etc/nginx/sites-available/reeeeee.tk.conf
server
{
# listen 443 ssl http2;
# listen [::]:443 ssl http2;
listen 80;
server_name api.reeeeee.tk;
# SSL
# ssl_certificate /etc/letsencrypt/live/api.reeeeee.tk/fullchain.pem;
# ssl_certificate_key /etc/letsencrypt/live/api.reeeeee.tk/privkey.pem;
# ssl_trusted_certificate /etc/letsencrypt/live/api.reeeeee.tk/fullchain.pem;
# HSTS
# add_header X-Frame-Options "SAMEORIGIN" always;
# add_header X-XSS-Protection "1; mode=block" always;
# add_header X-Content-Type-Options "nosniff" always;
# add_header Referrer-Policy "no-referrer-when-downgrade" always;
# add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
access_log /var/log/nginx/api.reeeeee.tk-access.log;
error_log /var/log/nginx/api.reeeeee.tk-error.log;
server_tokens off;
location /
{
proxy_pass http://localhost:5000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
# ACME-challenge
location ^~ /.well-known/acme-challenge/
{
root /var/www/_letsencrypt;
}
}
I created a /var/www/_letsencrypt directory and chowned it with the user: "www-data"
https://imgur.com/KBKTapE
I then succesfully ran Certbot:
https://i.imgur.com/2glcHVn.jpg
After succesfully running Certbot, I got rid of all the "#"'s so the ".conf" file now looks like:
/sites-enabled/reeeeee.tk.conf
server
{
listen 443 ssl http2;
listen [::]:443 ssl http2;
listen 80;
server_name api.reeeeee.tk;
# SSL
ssl_certificate /etc/letsencrypt/live/api.reeeeee.tk/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/api.reeeeee.tk/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/api.reeeeee.tk/fullchain.pem;
# HSTS
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
access_log /var/log/nginx/api.reeeeee.tk-access.log;
error_log /var/log/nginx/api.reeeeee.tk-error.log;
server_tokens off;
location /
{
proxy_pass http://localhost:5000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
# ACME-challenge
location ^~ /.well-known/acme-challenge/
{
root /var/www/_letsencrypt;
}
}
I restarted Nginx
https://i.imgur.com/oUXWHAM.png
BUT the site is still not HTTPS secured.
http://www.reeeeee.tk/api/movies
Did I get an SSL certificate? What did I do wrong? Do you see anything in the screenshots or code that I did wrong?
Where do I go from here? How do I get a working SSL cert and an HTTPS secured site?
I was following advice I got from this Reddit thread. ALL further context is in here if I didn't post enough info:
https://www.reddit.com/r/nginx/comments/z88yra/trying_to_get_ssl_certificate_for_backend_where/
Was this person just wrong? Did I do it wrong from the beginning? Do I have to start over?