Ah, got it! Thanks.

The main wiki descriptor is generated with the host you use the first time you access it, but that assume your properly configured your proxy as an actually proxy and don’t hide the source host.
Ok, I understand.
I now configured “SSL” and “Alias” (called like this, contains the host name) (hopefully) properly and am curious how the next notification mails will look like.
Interestingly, the annotation feature now still works, in contrast to the configuration using xwiki.cfg.
I’m also now passing the original host name through the reverse proxy BTW.