W8 is moot: sorb confirms UDM SSH was disabled long ago.
W1 turns out to interact with #0007, which did not exist when the audit was
written. CFGMON routes ~axion1337.de to the lab resolver, and Traefik's DNS-01
renewal verifies TXT propagation — had it used the system resolver, that check
would ask the UDM and might never see the challenge record, failing renewal
silently until the certificates expire. It does not, because the config pins
public resolvers explicitly; that line is load-bearing rather than cosmetic and
is now documented as such. What the UDM actually answers for the zone remains
unverified, with the commands to check it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Thore CimbalandClaude Opus 4.8
e49c80a2c9