Actually fix letsencrypt issue.

functions

@@ -461,8 +461,11 @@ EOF
 
   cat <<EOF
 
-# Everything else requires a Google session.
-location ~ ^/ {
+# Everything else requires a Google session. The negative lookahead leaves
+# /.well-known/acme-challenge to the plain prefix location dokku-letsencrypt
+# writes during HTTP-01 renewal; a regex catch-all would otherwise shadow
+# it and the challenge would get a 401.
+location ~ ^/(?!\.well-known/acme-challenge(/|$)) {
     auth_request ${GOOGLE_AUTH_ROUTE_PREFIX}/verify;
     auth_request_set \$google_auth_user \$upstream_http_x_auth_request_user;
     auth_request_set \$google_auth_email \$upstream_http_x_auth_request_email;