traefik: enable the dashboard router now that traefik.shcnw.ru exists

Both pre-cutover prerequisites are satisfied:

- Port 80 NAT moved back to the docker host (192.168.0.9); verified externally
  that :80 is answered there. This is what lets the exchange-acme router forward
  /.well-known/acme-challenge/ to Exchange and replace the manual NAT repoint that
  every past win-acme renewal has needed.
- traefik.shcnw.ru A 217.15.22.194 created, so the dashboard router is uncommented.

The router was shipped disabled because ACME validates from the internet even for
a LAN-only router — ipAllowList gates access, not issuance. That rule is now
stated explicitly in the README rather than left as a one-off note, since it
applies to every LAN-only host in this stack (start, portainer, cockpit).

The earlier pre-flight already parsed this exact router (it got as far as
attempting issuance for traefik.shcnw.ru and failing on NXDOMAIN), so the
uncomment is not introducing anything unvalidated.

Host restage of dynamic/services.yml is still PENDING — the 43009 tunnel went down
before it could be copied. The host currently holds the previous revision, in
which the dashboard router is absent. Everything else is identical, so a deploy
before the restage would come up correctly minus the dashboard.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

traefik/README.md

@@ -92,17 +92,16 @@ provider starts. The only errors are ACME issuance failures — **expected**, be
 
 ---
 
-## ⚠️ Before cutover — two prerequisites
+## Before cutover — prerequisites (both satisfied 2026-08-26)
 
-**1. Port 80 must be NAT'd to the docker host (`192.168.0.9`).** It is currently pointed at
-**Exchange** (`192.168.0.6`) — repointed by hand on 2026-08-26 so win-acme could renew. Traefik's
-`exchange-acme` router is what replaces that manual step permanently, but it can only do so if `:80`
-arrives at Traefik. **Move it back to `192.168.0.9` as part of the cutover.**
+**1. Port 80 NAT → docker host (`192.168.0.9`) — done 2026-08-26.** Verified: `:80` is answered by
+the docker host. This is what lets `exchange-acme` replace the manual NAT repoint that every past
+Exchange renewal has needed. **Do not point `:80` back at Exchange** — it would break the L7
+redirect and is no longer necessary.
 
-**2. `traefik.shcnw.ru` has no DNS record.** The dashboard router is shipped **commented out** for
-that reason — ACME validates from the internet even for a LAN-only router. Create
-`traefik.shcnw.ru A 217.15.22.194`, then uncomment the router (hot-reloads, no restart). The
-htpasswd is already staged.
+**2. `traefik.shcnw.ru` DNS — done 2026-08-26** (`A 217.15.22.194`), so the dashboard router is
+enabled. Note the general rule: a LAN-only router still needs a **public** A-record, because ACME
+validates from the internet; `ipAllowList` gates *access*, not issuance.
 
 ---
 

traefik/dynamic/services.yml

@@ -144,17 +144,15 @@ http:
       service: cockpit
       middlewares: [lan-only]
       tls: { certResolver: le }
-    # ---- Traefik dashboard: DISABLED until DNS exists ----
-    # `traefik.shcnw.ru` is NXDOMAIN as of 2026-08-26. ACME (TLS-ALPN, like HTTP-01)
-    # validates from the internet, so a public A-record -> 217.15.22.194 is required
-    # even though the router is LAN-only. Create the record, then uncomment — this
-    # file hot-reloads, no restart needed. The htpasswd is already staged on the host.
-    # dashboard:
-    #   entryPoints: [websecure]
-    #   rule: "Host(`traefik.shcnw.ru`)"
-    #   service: api@internal
-    #   middlewares: [lan-only, dash-auth]
-    #   tls: { certResolver: le }
+    # ---- Traefik dashboard (LAN-only + basic-auth) ----
+    # Needs a PUBLIC A-record even though access is LAN-only, because ACME validates
+    # from the internet. traefik.shcnw.ru -> 217.15.22.194 created 2026-08-26.
+    dashboard:
+      entryPoints: [websecure]
+      rule: "Host(`traefik.shcnw.ru`)"
+      service: api@internal
+      middlewares: [lan-only, dash-auth]
+      tls: { certResolver: le }
 
   # ===========================================================================
   # Services (backends) — mirror the NPM proxy-host forward targets