Better you build external nginx with reverse proxy to your downstream cluster.

Using HA with corosync, pacemaker and pcs

If you need some documentation, I'm happy to share

Since it's using HA reverse proxy, you can copy the letsencrypt certificate to second nginx

The downstream culster of rancher rke2, already take over the port 80 and 443 in the node, so you need external nginx as reverse proxy