+1 for the letsencrypt wildcard with DNS verification, been using this for years. with dehydrated (https://github.com/dehydrated-io/dehydrated) you can automate renewing the certs, pretty convenient.

One thing i didn’t see mentioned yet - you can also easily create a wildcard for a subdomain of your domain, e.g. *.local.example.com. Most DNS providers let you define something like _acme-challenge.local IN TXT ... so you don’t even need to define an extra zone for local.example.com. Probably makes no big difference, but i like it ^^

I had used /e/ as a daily driver for about a year, on one of the officially supported phones (FP3). Installation was easy, and coming from other custom ROMs I remember thinking "wow, this just works!” ;) Didn’t use any of the /e/ services, things worked fine connected to a self-hosted nextcloud.

For a usability I think this is how painless an alternative ROM should be if it wants to reach a wider audience.