Configure relay for production certificate resolver

IMPLEMENTATION_STATUS.md

@@ -194,6 +194,7 @@
 - `relay-server/.env.example` now contains a non-secret placeholder for `ADMIN_TOKEN` instead of a committed credential. Before deployment, generate and set a unique value in the untracked `relay-server/.env` file.
 - Verified the Docker Compose configuration with the example environment and confirmed a local relay instance responds successfully from `GET /health`.
 - Extended WebSocket serialization coverage to preserve the sender timestamp used for offline message delivery.
+- The relay now defaults to the production Traefik certificate resolver (`myresolver`) and allows a host-specific override through `TRAEFIK_CERT_RESOLVER`.
 
 ## Bug Fixes — Post-Review ✅
 

relay-server/.env.example

@@ -2,5 +2,7 @@ PORT=3000
 MAX_FILE_SIZE_MB=25
 UPLOADS_DIR=/data/files
 FILE_TTL_DAYS=30
+# Must match the certificate resolver configured by the host Traefik instance.
+TRAEFIK_CERT_RESOLVER=myresolver
 # Required for POST /admin/cleanup. Generate a unique value, for example: openssl rand -hex 32
 ADMIN_TOKEN=replace-with-a-unique-random-secret

relay-server/docker-compose.yml

@@ -14,7 +14,7 @@ services:
       - "traefik.enable=true"
       - "traefik.http.routers.fchati.rule=Host(`fchati.diyaa.de`)"
       - "traefik.http.routers.fchati.entrypoints=websecure"
-      - "traefik.http.routers.fchati.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.fchati.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-myresolver}"
       - "traefik.http.services.fchati.loadbalancer.server.port=3000"
 
 volumes: