SatSale has built-in webserver, but for TLS you will need nginx proxy or something similar in front. For cert you can use certbot to get it from Let’s Encrypt.
Discussion
Lightning address spec supports .onion identifiers too, then you don’t need all this, but not sure how good and widespread is wallet support for paying to such addresses via Tor.