> For now, it is very simple: there is a VM (running on FreeBSD and bhyve, on hardware I manage) where I have installed SmartOS. The physical host also runs the reverse proxy (in a jail). Inside the SmartOS VM, there are a series of zones: [...]

That is a weird take, to install SmartOS inside a VM for anything else than a PoC. SmartOS is meant to run on bare metal and host its own VMs / zones. It works either way of course but it's funny for an "Illumos cafe" to not go full on Illumos on the setup.