Including the nginx role as @carsongee has proposed is one option to do this easily.  We can also put this behind and ELB and terminate SSL there, but that makes the role less complete.