I think the goatcounter guide should use the argument -tls proxy for calling goatcounter instead of -tls http to reflect the setup which uses nginx for https.
Citing goatcounter help listen:
If you want to serve GoatCounter behind a proxy (HAproxy, Varnish, Hitch,
nginx, Caddy, whatnot) then you'll want to use something like:
goatcounter serve -listen localhost:8081 -tls proxy
And then forward requests on port 80 and 443 for your domain to
localhost:8081. This assumes that the proxy will take care of the TLS
certificate story.
I don't know exactly what difference this makes and both work on version 2.6 (current version). Because of that I made this an issue and not a pull request.
See also: Issue #795 in goatcounter