Prod: switch Let's Encrypt from HTTP-01 to Route 53 DNS-01

Certificates no longer depend on public port 80 reaching this host, and a
name can be certified before its A record points here (backyardhoneycomb.com
migration). Uses IAM user traefik-prod-dns01 from .env (AWS_REGION must be
set; the SDK needs it even for global Route 53), allowed only to write
_acme-challenge.* TXT records in the pkartchner.com and backyardhoneycomb.com
zones.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

traefik.yml

@@ -59,10 +59,19 @@ certificatesResolvers:
     acme:
       email: pkartch@gmail.com
       storage: acme.json
-      # HTTP-01: public port 80 forwards to this host, so the challenge
+      # DNS-01 via Route 53 (since 2026-11-03; was HTTP-01). Proves control with
-      # reaches us directly. The dev host cannot use this — see traefik.dev.yml.
+      # an _acme-challenge TXT record, so certificates no longer depend on public
-      httpChallenge:
+      # port 80 reaching this host, and a name can be certified before its A
-        entryPoint: http
+      # record points here (e.g. a site migration). Credentials: IAM user
+      # traefik-prod-dns01 in .env, allowed ONLY to write _acme-challenge.* TXT
+      # records in the pkartchner.com and backyardhoneycomb.com zones.
+      dnsChallenge:
+        provider: route53
+        # Check propagation against public resolvers: Pi-hole answers for
+        # internal names and never sees the TXT record.
+        resolvers:
+          - "1.1.1.1:53"
+          - "8.8.8.8:53"
 
 log:
   level: INFO