My installations of Roundcube are revealing details of my configuration that I don't want them to reveal. Specifically, Roundcube is sending the HTTP_HOST string as the local ID when connecting to SMTP and I don't want it to. The hostname a user connects to shouldn't be used in the outgoing SMTP's Received: from header, as in some cases those are .onion addresses I don't want to be public.
I'm sure this is a FAQ, so I apologize in advance.
I answered my own question. If anyone else is unsure, it's the
$config['smtp_helo_host'] setting.
Unfortunately it doesn't appear to support any of the standard expansions. I would love if it could support %s or %h (a la imap_host / smtp_host). Consider this my vote for that functionality.