[Question] Delegating acme-challenge to secondary server

I'm trying to use lua-resty-auto-ssl 0.12.1 with two openresty instances in different regions that are using dns-based failover with health checks.

I'm having trouble getting the backup server to register certificates (likely for renewal), while it is not the active server, because obviously acme-challenges are hitting the wrong server.

My idea was to change the nginx config, so that the `auto_ssl:challenge_server()` is in a separate server block and then use an upstream block with the local acme server as primary and remote acme server as backup and enable retries on 404.

However, for some reason this doesn't work, even though the failover on 404 from the local challenge server appears to be working.

Here's a reduced config, with all the non-essential setup omitted:

```nginx
http {
upstream acme_servers {
server 127.0.0.1:8998;
server backup.example.org:80 backup;
}
# default web server
server {
listen 80;
location /.well-known/acme-challenge/ {
# This works:
#content_by_lua_block {
# auto_ssl:challenge_server()
#}
# This does not:
proxy_next_upstream http_404;
proxy_pass http://acme_servers;
break;
}
}
# auto-ssl acme server
server {
listen 127.0.0.1:8998;
location /.well-known/acme-challenge/ {
content_by_lua_block {
auto_ssl:challenge_server()
}
}
}
}
```

In theory this should work fine:

When adding/renewing a cert on the backup server, the acme-challenge request from the Let's Encrypt validations server should hit the primary server, which would get a 404 from its local acme server and then retry against the backup server in the upstream config.

However, in practice this doesn't work and both the primary and secondary acme server return a 404.

**Any idea what's going wrong or how this could be solved better?**

If possible I'd like to avoid the overhead of adding a redis-cluster with failover just to share the certs.

Another idea would be to use dns-01 challenge and update records in route 53, but it seems that's not currently possible with lua-resty-auto-ssl.

No repository file or test is named. Start by reproducing the reduced nginx configuration and tracing the auto_ssl:challenge_server() entry point and proxy_next_upstream http_404 behavior. Done would require a confirmed explanation of the two 404 responses and a documented, tested way to support certificate validation across the primary and secondary servers.

Written by the indexing model from the issue text.