diff --git a/continuwuity.hcl b/continuwuity.hcl
index 7cfe132..0080821 100644
--- a/continuwuity.hcl
+++ b/continuwuity.hcl
@@ -19,29 +19,19 @@ job "continuwuity" {
       tags = [
         "traefik.enable=true",
 
-        # --- Homeserver (client + federation API) on cn.i80.dk ---
+        # Homeserver (client + federation API) on cn.i80.dk.
+        # server_name = cn.i80.dk, so continuwuity serves its own /.well-known/matrix/* here —
+        # no apex delegation needed, nothing to change in trinity/nginx.
+        # NOTE: routing is actually done by trinity's nginx zone-generator (cn.i80.dk.conf),
+        # not Traefik; these tags are kept for documentation/compatibility.
         "traefik.http.routers.continuwuity.rule=Host(`cn.i80.dk`)",
         "traefik.http.routers.continuwuity.entrypoints=https",
         "traefik.http.routers.continuwuity.tls=true",
-        # No certresolver: Traefik serves the *.i80.dk wildcard cert from /certs via SNI.
 
-        # --- Delegation: server_name is i80.dk, so the apex must serve /.well-known/matrix/* ---
-        # MXIDs become @user:i80.dk; federation/clients resolve i80.dk -> cn.i80.dk.
-        "traefik.http.routers.continuwuity-wk.rule=Host(`i80.dk`) && PathPrefix(`/.well-known/matrix`)",
-        "traefik.http.routers.continuwuity-wk.entrypoints=https",
-        "traefik.http.routers.continuwuity-wk.tls=true",
-        # Higher priority so it wins over any bare Host(`i80.dk`) website router.
-        # NOTE: requires the cert to include i80.dk as a SAN (a *.i80.dk wildcard alone does NOT cover the apex).
-        "traefik.http.routers.continuwuity-wk.priority=100",
-
-        # --- http -> https redirect for both routers ---
+        # http -> https redirect for cn.i80.dk
         "traefik.http.routers.continuwuity-http.rule=Host(`cn.i80.dk`)",
         "traefik.http.routers.continuwuity-http.entrypoints=http",
         "traefik.http.routers.continuwuity-http.middlewares=continuwuity-redirect",
-        "traefik.http.routers.continuwuity-wk-http.rule=Host(`i80.dk`) && PathPrefix(`/.well-known/matrix`)",
-        "traefik.http.routers.continuwuity-wk-http.entrypoints=http",
-        "traefik.http.routers.continuwuity-wk-http.middlewares=continuwuity-redirect",
-        "traefik.http.routers.continuwuity-wk-http.priority=100",
         "traefik.http.middlewares.continuwuity-redirect.redirectscheme.scheme=https",
         "traefik.http.middlewares.continuwuity-redirect.redirectscheme.permanent=true",
       ]
@@ -102,15 +92,16 @@ job "continuwuity" {
       driver = "docker"
 
       env {
-        # server_name is PERMANENT — it is the suffix of every user/room ID (@henrik:i80.dk).
-        CONTINUWUITY_SERVER_NAME        = "i80.dk"
+        # server_name is PERMANENT — it is the suffix of every user/room ID (@henrik:cn.i80.dk).
+        # Self-contained on cn.i80.dk: continuwuity serves its own well-known, no apex delegation.
+        CONTINUWUITY_SERVER_NAME        = "cn.i80.dk"
         CONTINUWUITY_TRUSTED_SERVERS    = "[\"matrix.org\"]"
         CONTINUWUITY_ALLOW_REGISTRATION = false
         CONTINUWUITY_ADDRESS            = "0.0.0.0"
         CONTINUWUITY_PORT               = 6167
         CONTINUWUITY_DATABASE_PATH      = "/var/lib/continuwuity"
 
-        # Delegation: the homeserver lives at cn.i80.dk, advertised via the apex .well-known.
+        # well-known served by continuwuity itself on cn.i80.dk (proxied through trinity's nginx).
         # client = base URL (no port); server = host:port for federation.
         CONTINUWUITY_WELL_KNOWN = <<EOF
 {
@@ -123,7 +114,7 @@ EOF
         # To create your account once, temporarily set:
         #   CONTINUWUITY_ALLOW_REGISTRATION = true
         #   CONTINUWUITY_REGISTRATION_TOKEN = "<long-random-secret>"
-        # register @henrik:i80.dk with that token, then revert to allow_registration=false and redeploy.
+        # register @henrik:cn.i80.dk with that token, then revert to allow_registration=false and redeploy.
       }
 
       config {