And we get nested blocks for free.
Always listen on all hosts. Only use the host part of a frontend address for TLS cert names. Customizing the listen host will be better done with a `bind` directive, like Caddy does.
This allows us to expose the toplevel tlstunnel package.