fleet-manager: pass optional AWS_HOSTED_ZONE_ID to the acme side-car

lego auto-discovers the Route 53 zone via ListHostedZonesByName, so the zone ID
is optional — but pinning it disambiguates overlapping public/private zones and
lets the IAM policy drop the list permission. Thread it through compose + .env
+ DEPLOY.md (no script change; lego reads it from the environment).

serving/fleet-manager/.env.example

@@ -28,6 +28,9 @@ ACME_EMAIL=you@bitasylum.org
 AWS_ACCESS_KEY_ID=
 AWS_SECRET_ACCESS_KEY=
 AWS_REGION=us-east-1
+# Optional but recommended: pin the Route 53 zone. Skips ListHostedZonesByName
+# (so you can drop it from the IAM policy) and disambiguates public/private zones.
+AWS_HOSTED_ZONE_ID=
 # ACME_STAGING=1   # uncomment for a dry-run vs LE staging (UNTRUSTED certs, no rate limit)
 
 # --- agent plane (gRPC + mTLS, fleet CA) ---------------------------------------

serving/fleet-manager/DEPLOY.md

@@ -120,6 +120,12 @@ instance role and omit them):
 }
 ```
 
+`AWS_HOSTED_ZONE_ID` is **optional**: lego auto-discovers the zone via
+`ListHostedZonesByName` (hence that statement). Set it in `.env` to pin the zone
+— required if a **public + private** zone share `bitasylum.org` (auto-discovery
+may pick the wrong one), and it lets you **drop the `ListHostedZonesByName`
+statement** for a tighter policy.
+
 **Run it** (bring the side-car up first so the cert exists before the manager):
 
 ```bash

serving/fleet-manager/docker-compose.yml

@@ -129,6 +129,9 @@ services:
       AWS_ACCESS_KEY_ID: "${AWS_ACCESS_KEY_ID:-}"
       AWS_SECRET_ACCESS_KEY: "${AWS_SECRET_ACCESS_KEY:-}"
       AWS_REGION: "${AWS_REGION:-us-east-1}"
+      # Optional: pin the zone (skips the ListHostedZonesByName lookup — needed if
+      # a public + private zone share the domain; lets you tighten the IAM policy).
+      AWS_HOSTED_ZONE_ID: "${AWS_HOSTED_ZONE_ID:-}"
     volumes:
       - ./acme/renew-loop.sh:/renew-loop.sh:ro
       - acme-state:/le               # lego account + cert store — PERSIST