Document the Traefik label loss and certificate refresh

README.md

@@ -107,6 +107,11 @@ For testing against Let's Encrypt staging (untrusted certificates, separate
 rate limits), set
 `ACME_DIRECTORY_URL=https://acme-staging-v02.api.letsencrypt.org/directory`.
 
+The official CLI checks the certificate every 12 hours (every minute within
+30 days of expiry) and applies a renewed certificate to new connections; after
+switching the server's issuer, restart the CLI service (`opentunnel down` /
+`opentunnel up`) to fetch the new certificate immediately.
+
 ## Admin dashboard
 
 With `ADMIN_TOKEN` set, `https://<domain>/` (and `/admin`) serves the admin
@@ -148,6 +153,9 @@ untouched by SNI, because visitor TLS is terminated by the clients:
   `...rule=HostSNIRegexp(`^.+\.tunnel\.example\.com$`)`,
   `...tls.passthrough=true`,
   `traefik.tcp.services.tunnel-data.loadbalancer.server.port=8443`.
+  After any app update or recreation, confirm the TCP labels are still in
+  `custom_labels`: Coolify has dropped them when regenerating labels, leaving
+  Traefik to terminate tunnel SNI with its default certificate.
 - Persistent volume on `/app/data`; healthcheck on `/health`.
 
 **B. Plain Docker host.** tunneld owns the public ports itself: map host