.gitignore

@@ -23,3 +23,7 @@ Thumbs.db
 *.swp
 *.swo
 *~
+
+# Previous .env kept by the key rotator (traefik-key-receive) for rollback.
+.env.pre-rotate
+*.bak-*

traefik.yml

@@ -59,10 +59,19 @@ certificatesResolvers:
     acme:
       email: pkartch@gmail.com
       storage: acme.json
-      # HTTP-01: public port 80 forwards to this host, so the challenge
+      # DNS-01 via Route 53 (since 2026-11-03; was HTTP-01). Proves control with
-      # reaches us directly. The dev host cannot use this — see traefik.dev.yml.
+      # an _acme-challenge TXT record, so certificates no longer depend on public
-      httpChallenge:
+      # port 80 reaching this host, and a name can be certified before its A
-        entryPoint: http
+      # record points here (e.g. a site migration). Credentials: IAM user
+      # traefik-prod-dns01 in .env, allowed ONLY to write _acme-challenge.* TXT
+      # records in the pkartchner.com and backyardhoneycomb.com zones.
+      dnsChallenge:
+        provider: route53
+        # Check propagation against public resolvers: Pi-hole answers for
+        # internal names and never sees the TXT record.
+        resolvers:
+          - "1.1.1.1:53"
+          - "8.8.8.8:53"
 
 log:
   level: INFO