TLS: letsencrypt DNS-01 via Dynadot hook; fail2ban ignoreip guard (#114)

- scripts/dynadot-dns.sh: DNS-01 hook (snapshot -> append TXT -> restore);
  set_dns2 wants lowercase record types, ResponseCode checks on deploy/clean
- compose: SSL_TYPE=letsencrypt, mount tls/letsencrypt/<domain> ->
  /etc/letsencrypt/live/<domain>; drop-in jail.d/ignoreip.local so the
  postfix jail can't ban the docker bridge gateway (host self-DoS)
- cert issued for mail.produktor.io (Let's Encrypt, ECDSA); renewal via
  acme.sh cron + reloadcmd (postfix/dovecot reload)

compose.yaml

@@ -14,16 +14,16 @@ services:
       - ./data/mail-state/:/var/mail-state/
       - ./data/mail-logs/:/var/log/mail/
       - ./config/:/tmp/docker-mailserver/
-      - ./tls/mail.key:/tmp/docker-mailserver/ssl/mail.produktor.io-key.pem:ro
-      - ./tls/mail.crt:/tmp/docker-mailserver/ssl/mail.produktor.io-cert.pem:ro
-      - ./tls/mail.crt:/tmp/docker-mailserver/ssl/demoCA/cacert.pem:ro
+      # fail2ban: never ban the docker bridge gateway / host LAN (self-DoS guard)
+      - ./config/fail2ban/ignoreip.conf:/etc/fail2ban/jail.d/ignoreip.local:ro
+      - ./tls/letsencrypt/mail.produktor.io:/etc/letsencrypt/live/mail.produktor.io:ro
       - /etc/localtime:/etc/localtime:ro
     environment:
       - ENABLE_SPAMASSASSIN=1
       - ENABLE_CLAMAV=0
       - ENABLE_FAIL2BAN=1
       - ENABLE_POP3=0
-      - SSL_TYPE=self-signed
+      - SSL_TYPE=letsencrypt
       - PERMIT_DOCKER=none
       - ONE_DIR=1
       - SPOOF_PROTECTION=1