Another question is subdomain support: to have a catch all virtual host that will respond to anything.domain.tld and have wildcard letsenrypt enabled ssl with DNS challenge.
Those two problems make me think that my side gig has grown up enough to switch to ArgoCD/K8s, although there are many other problems that come with it (from my experience on the day job). For now I just do the certificate rotation manually, which is not much ideal but works with a couple make targets.