With Traefik as the cluster gateway in front of local DNS like Technitium, TLS stays healthy when the ACME solver and Host routers share entrypoints and the challenge path never depends on an app Service that may be down. I pin which entrypoint terminates websecure, keep the dashboard off the public listener, and make sure every router hostname resolves to the MetalLB or node address Traefik binds before flipping production traffic. DNS-01 against the lab resolver helps when HTTP-01 cannot reach the edge from the public internet.

After apply I watch certificate readiness and which secret each IngressRoute or Ingress references, then hit every hostname once to confirm the chain and matched router. Also verify X-Forwarded-Proto and the real client address still reach the upstream after Traefik terminates TLS — losing those on a label or CRD bump looks like an app redirect loop when it is still the proxy hop. An internal Service health probe, then the same path through the public Host, separates discovery drift from a real pod crash.