[Dovecot] how to config dovecot for multiple domains, multiple SSL certs, and conditional IP access -- with passwd-file passdb?

[PGNet Dev]

at them moment, i've configured dovecot for a flat passwd-file, annd
static userdb.  from dovecot.conf,

  ...
  auth default {
	mechanisms = plain digest-md5 cram-md5
	user = mail
        ...
	passdb passwd-file {
	  args = /data/mail/users/imap_user_file
	}
	userdb static {
	  args = static uid=mail gid=mail
home=/data/mail/store/Domains/%d/Accounts/%n
quota=maildir:storage=4096 nice=10
	}
	...

i'd like to configure dovecot to,

  host multiple domains, each on a separate IP
  setup a separate SSL cert for each domain
  respond with a different login_greeting for each domain
  restrict access to, and access type (e.g., TLS req'd vs noTLS,
secure auth OK) of, imap login based with conditional rules based on
the guest's IP address.

all of these things are currently implemented on the non-dovecot imap
server i'm migrating _from_, and i'd like to preserve these
capabilities.

can any/all of these be accomplished with a passwd-file flatfile
lookup?  i know i can restrict IP access in passwd-file with
'allow_nets=', but atm i'm unclear how i'd do that for multiple
domains, etc.

i understand that much can be accomplished with custom SQL queries,
but for a small install would _prefer_ to stay flat file.  i'm finding
bits & pieces of capability in docs, etc -- but, so far, nothing
comprehensive/all-inclusive.  which makes me wonder a bit -- why not?

any comments/advice would be much appreciated.

thanks!