Custom domain behind Nginx Proxy Manager - how generate certificate

Self-hosted Appwrite behing Nginx Proxy Manager. NPM takes care of certificates via DNS challenge. I want to add new Custom Domain but it is failing at the certificate generation step:

Failed to issue a certificate with message: Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Performing the following challenges:
http-01 challenge for domain.example.com
Using the webroot path /storage/certificates for all unmatched domains.
Waiting for verification...
Challenge failed for domain domain.example.com
http-01 challenge for domain.example.com
Cleaning up challenges
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

How to get pass this verification failure? Can I disable Appwrite from trying to gen certificate for the custom domain? Can I configure Appwrite to use DNS challenge?

there's no need to generate a custom domain because NPM already generates the certificate.

hm, are you sure about that? I need a custom domain in order to be able to properly set the authentication cookie for my app. If I do not set a custom domain (e.g. appwrite.mydomain.com) for my app (app.mydomain.com) I am not able to propely login. What am I missing?

you can just do that in NPM.

also, make sure you're proxying from NPM to appwrite using HTTPS and not http

aha, so custom domains are only needed when we are using Appwrite's Traefik as proxy? thank you, <@462046107556511744> !

I have this question too, im using my appwrite behind a proxy (npm) everything working perfectly fine, but, the only problem i have is using oauth2 appwrite fails because this error: project_invalid_success_url so i tried to add custom domain on the project, but it fails because the domain verification... so, how? my domain (appwrite.mydomain.com) already has a valid ssl from nginx proxy manager... but it fails the oauth2