I'll probably hoist the config to a global level, since I imagine most users will want to specify just one outer SNI for the whole server, and have all defined sites encapsulated within it.

config likely to change

Browser loaded domain using inner SNI

Wireshark shows outer SNI only

Hello.

Today, @caddy.bsky.social completed its first ECH handshake.

It completely automated the "HTTPS"-type DNS record and TLS certificates for both inner and outer SNI.