DNS-01 challenge (no inbound HTTP required)

If the box is not reachable on port 80 from the internet, use the DNS-01
challenge. Certbot asks you to add a TXT record to your DNS zone to prove you
control the domain. No inbound connection to the box is needed.

1. In the BNG management UI: About → Manage TLS cert → Generate
   certbot script → select the DNS-01 tab.
2. Fill in the same hostname and email fields, then copy and run the script:

   sudo bash certbot-dns01-setup.sh

3. Certbot will pause and display a TXT record to add, for example:

   Please deploy a DNS TXT record under the name:
   _acme-challenge.bng-site-a.example.com
   with the following value: <token>

4. Add that TXT record in your DNS provider's control panel.
5. Wait at least 60 seconds for the record to propagate, then press Enter in
   the certbot terminal to continue. Certbot verifies the record and issues the
   certificate.
6. The script copies the cert and key to /var/lib/quantum-controller/tls/ and
   signals gunicorn to reload.