Via dokku-letsencrypt.
First ssh into the machine, then:
sudo dokku plugin:install https://github.com/dokku/dokku-letsencrypt.git
Then from outside the machine:
ssh [email protected] config:set --no-restart api [email protected]
ssh [email protected] letsencrypt api
dt letsencrypt:auto-renew