Choose "No" when asked to use built-in webserver, this will run SM in http only on port 17017 giving you a target to route from via nginx, caddy, etc.

Hi Matt

Thanks for this information. 

I'm aware of that.

My question is more this:

If I can simply add additional host entries in Kestel, then I'd be happy to skip the reverse proxy.

But if it's easier with nginx, then I'll go that route.

you shouldn't need any host entries for kestrel, as long as your A records are pointing to your server we'll process the call, we use SNI for dynamic cert matching.

So all you need to do for a new subdomain or domain to be served by kestrel/SmarterMail (and have a certificate made) is 
1. Point the A record to SmarterMail
2. Have a domain, domain alias, that matches in SM

2.5. Make sure your ports are open on the machine.
3. Make sure automatic cert generation is on.

4. (wait) Then try https://<domain> in your browser, should work!

That's it, you may have to wait some time for the cert to get brought in but there is no other setup.

Hi Matt

That's awesome. Many thanks for this helpful answer.