From 33e90493b7370036a82f59941cd7131d0f6c998f Mon Sep 17 00:00:00 2001 From: Paul R Kartchner Date: Tue, 3 Nov 2026 14:47:07 -0700 Subject: [PATCH] Prod: switch Let's Encrypt from HTTP-01 to Route 53 DNS-01 Certificates no longer depend on public port 80 reaching this host, and a name can be certified before its A record points here (backyardhoneycomb.com migration). Uses IAM user traefik-prod-dns01 from .env (AWS_REGION must be set; the SDK needs it even for global Route 53), allowed only to write _acme-challenge.* TXT records in the pkartchner.com and backyardhoneycomb.com zones. Co-Authored-By: Claude Opus 5.5 --- traefik.yml | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/traefik.yml b/traefik.yml index 65437e1..e5cef07 100644 --- a/traefik.yml +++ b/traefik.yml @@ -59,10 +59,19 @@ certificatesResolvers: acme: email: pkartch@gmail.com storage: acme.json - # HTTP-01: public port 80 forwards to this host, so the challenge - # reaches us directly. The dev host cannot use this — see traefik.dev.yml. - httpChallenge: - entryPoint: http + # DNS-01 via Route 53 (since 2026-11-03; was HTTP-01). Proves control with + # an _acme-challenge TXT record, so certificates no longer depend on public + # port 80 reaching this host, and a name can be certified before its A + # record points here (e.g. a site migration). Credentials: IAM user + # traefik-prod-dns01 in .env, allowed ONLY to write _acme-challenge.* TXT + # records in the pkartchner.com and backyardhoneycomb.com zones. + dnsChallenge: + provider: route53 + # Check propagation against public resolvers: Pi-hole answers for + # internal names and never sees the TXT record. + resolvers: + - "1.1.1.1:53" + - "8.8.8.8:53" log: level: INFO