fix: persist Let's Encrypt certificates across container lifecycle

[iambaboucarr]

Summary

• Replace the cert Docker named volume with a ./traefik/cert bind mount so ACME certificates persist through docker compose down --volumes, container recreation, and volume prune operations.
• Add configurable LETSENCRYPT_ACME_CASERVER env var (defaults to production) so operators can switch to the Let's Encrypt staging server during testing to avoid rate limits.
• Update the Ansible deploy role to create traefik/cert/ directory and traefik/cert/acme.json with correct ownership, aligning it with the new bind mount path.

Problem

Running the deployment multiple times (e.g. make clean && make launch) would destroy the cert named volume each cycle, wiping all cached certificates and ACME account data. Traefik then re-requested certificates from production Let's Encrypt, hitting the 5 duplicate certificates per week rate limit after a few iterations. Once rate-limited, Traefik could not obtain valid certificates and browsers showed certificate errors as encountered by @bobjolliffe during his last demo.

Test plan

• Fresh deployment: verify ./traefik/cert/acme.json is created with correct permissions (600, nobody:nobody)
• Restart cycle: run make clean and make launch to confirm that certificates are preserved
• Staging server: set LETSENCRYPT_ACME_CASERVER to staging URL, verify Traefik uses staging CA
• Ansible deploy: run playbook on a test host, confirm traefik/cert/acme.json is created at the correct path

[radnov]

I think the PR is good, if we were to accept the bind mount approach.

However, I'd rather we keep using a volume for the cert, unless a bind mount is really necessary.

I would go with changing make clean to something like:

• make clean-all (with --volumes opt - destroys volumes, with confirmation prompt)
• make clean (doesn't destroy volumes)

Also, the extra LetsEncrypt Staging env var is good idea in any cases. 👍

[radnov]

LGTM 👍 Well done!

[tonsV2]

Isn't this folder created automatically by Docker when we mount the volume?

[tonsV2]

Shouldn't this whole task be removed since we're handling all of this in an init container now?

[iambaboucarr]

The original task was introduced by you in a previous PR. We can discuss the removal in an upcoming call

[tonsV2]

I think this line is a leftover from when we initially used a bind mount for the acme file

[iambaboucarr]

It's important to retain the .ansible/ dir, as IDEs that have the Ansible extension installed (e.g on VSCode) will create a .ansible/ dir.

[tonsV2]

This comment seems a bit redundant 🙂

[tonsV2]

It really doesn't 😂

[iambaboucarr]

There is nothing funny here. This is a stale text from the original PR that used bind mount

[tonsV2]

When did we starting adding these comments? At the top of this file we ignore .idea which is also from an IDE

[iambaboucarr]

We had the comments from the very beginning of the project, although it was a bit inconsistent