And we get nested blocks for free.
To receive expiration warnings from Let's Encrypt.
Always listen on all hosts. Only use the host part of a frontend address for TLS cert names. Customizing the listen host will be better done with a `bind` directive, like Caddy does.