docs: document Let's Encrypt TLS provisioning and AutoModpack sync workflow

- Add Section 5 to docs/infrastructure-base.md detailing Certbot setup with Cloudflare DNS API.
- Document PKCS#8 private key conversion and .private/ certificate deployment.
- Document automatic 60-day renewal deploy hook for seamless TLS maintenance.
- Update Data Preservation Reference Matrix in docs/operations-manual.md to classify data/automodpack/.private/ as GitIgnored Secret.

docs/infrastructure-base.md

@@ -77,3 +77,58 @@ sudo resize2fs /dev/sda1
 # 4. Verify capacity (Target: ~190G+ available)
 df -h /
 ```
+
+---
+
+## 5. Automated SSL/TLS Certificate Provisioning (AutoModpack)
+
+AutoModpack uses TLS 1.3 to encrypt modpack distribution to clients. To prevent client "Certificate Verification" warnings, host-side Let's Encrypt certificates are issued via DNS-01 challenge and synced to AutoModpack in PKCS#8 format.
+
+### Prerequisites
+* **Domain DNS**: `mc.sotohome.top` configured on Cloudflare (DNS Only / Grey Cloud).
+* **Cloudflare API Token**: Scoped with `Zone.DNS` edit permissions for `sotohome.top`.
+
+### Package Installation
+```bash
+sudo apt update && sudo apt install -y certbot python3-certbot-dns-cloudflare
+```
+
+### Credentials & Issuance
+1. Save token to restricted host path `/etc/letsencrypt/cloudflare.ini`:
+   ```ini
+   dns_cloudflare_api_token = <YOUR_CLOUDFLARE_API_TOKEN>
+   ```
+2. Restrict file permissions:
+   ```bash
+   sudo chmod 600 /etc/letsencrypt/cloudflare.ini
+   ```
+3. Issue Let's Encrypt certificate:
+   ```bash
+   sudo certbot certonly \
+     --dns-cloudflare \
+     --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
+     -d mc.sotohome.top \
+     --non-interactive --agree-tos -m jgsc00@gmail.com
+   ```
+
+### AutoModpack Certificate Sync & PKCS#8 Conversion
+AutoModpack requires keys in **PKCS#8 PEM format** placed inside `runtime/data/automodpack/.private/`:
+```bash
+sudo openssl pkcs8 -topk8 -nocrypt \
+  -in /etc/letsencrypt/live/mc.sotohome.top/privkey.pem \
+  -out /tmp/key.pem
+
+sudo cp /etc/letsencrypt/live/mc.sotohome.top/fullchain.pem \
+  ~/mcserver/instances/forge-1.20.1-survival/runtime/data/automodpack/.private/cert.crt
+
+sudo cp /tmp/key.pem \
+  ~/mcserver/instances/forge-1.20.1-survival/runtime/data/automodpack/.private/key.pem
+
+sudo rm /tmp/key.pem
+sudo chown -R opc:opc ~/mcserver/instances/forge-1.20.1-survival/runtime/data/automodpack/.private/
+sudo chmod 600 ~/mcserver/instances/forge-1.20.1-survival/runtime/data/automodpack/.private/cert.crt
+sudo chmod 600 ~/mcserver/instances/forge-1.20.1-survival/runtime/data/automodpack/.private/key.pem
+```
+
+### Automatic Renewal Deploy Hook
+Certbot executes `/etc/letsencrypt/renewal-hooks/deploy/automodpack.sh` on 60-day auto-renewals to convert keys, update AutoModpack, and restart `mc_forge_server`.

docs/operations-manual.md

@@ -21,6 +21,7 @@ When performing world resets or maintenance, classify directories according to t
 | **Immutable** | `data/eula.txt` | EULA agreement file | **Preserve** |
 | **GitIgnored Secret** | `data/server.properties` | Generated server settings (contains RCON password) | Rebuilt on boot |
 | **GitIgnored Secret** | `.env` | Container environment variables | **Preserve** |
+| **GitIgnored Secret** | `data/automodpack/.private/` | CA-signed TLS certificates (`cert.crt`, `key.pem`) | **Preserve** |
 | **GitIgnored Runtime** | `data/config/lts_auth/players.json` | LTS Auth player account credentials | Delete on full reset |
 | **GitIgnored Runtime** | `data/config/fiw-mods-api/profiles/` | FIW anti-cheat player profiles | Delete on full reset |
 | **Volatile** | `data/world/` | Dynamic terrain & player data | Delete to reset seed |