fix(dstack-ingress): reject tls-alpn-01 wildcards at startup, not per pass

A wildcard under tls-alpn-01 can never succeed -- RFC 8737 forbids the
challenge for wildcard identifiers -- so it is a configuration error, not
a runtime failure. process_domain did reject it, but only once the
certificate loop reached that domain, by which point the container had
generated a placeholder certificate for a name that will never get a real
one, started haproxy serving it, and settled into retrying an
unsatisfiable config every 60s to 1800s forever.

Check it once at the top of tlsalpn.sh, before the startup sequence that
does all of the above. It belongs to tls-alpn-01, not to entrypoint.sh:
that file validates what both modes share and dispatches, and putting a
CHALLENGE_TYPE branch back in it is the mode-specific logic the split was
meant to remove -- HTTP-01 would then add a third.

Deliberately fatal for the container rather than skipping the one domain.
A mixed config did already contain the damage -- the other domains were
issued normally -- but it left a self-signed certificate served for the
wildcard indefinitely and a permanently failing loop, which reads as a
TLS bug rather than a typo.

The per-domain check is gone with it: the domain list comes from env vars
fixed for the container's lifetime, so it saw exactly what the startup
check saw and could not fire. legoman.py keeps its own check, which is a
real boundary -- it guards the ACME call and can be invoked standalone.
dns-01 wildcards are unaffected.

Author: kvinwang

custom-domain/dstack-ingress/README.md

@@ -325,7 +325,10 @@ Encrypt dropping expiry mail, and the container passes it for you.
 ### Limitations
 
 - **No wildcards.** RFC 8737 forbids tls-alpn-01 for wildcard identifiers, and
-  the CA will not offer the challenge. Use `dns-01` for `*.example.com`.
+  the CA will not offer the challenge. The container refuses to start rather
+  than serve a name it can never obtain a certificate for, so a wildcard
+  anywhere in `DOMAIN`/`DOMAINS` is a startup error even if the other names are
+  fine. Use `dns-01` for `*.example.com`.
 - **The gateway must be reachable on port 443.** The CA connects to port 443 of
   whatever the CNAME resolves to; the port is fixed by the protocol.
 - **CAA must permit `tls-alpn-01`.** A record left over from a `dns-01`

custom-domain/dstack-ingress/scripts/tlsalpn.sh

@@ -89,6 +89,26 @@ require_instance_id() {
     fi
 }
 
+# RFC 8737 forbids tls-alpn-01 for wildcard identifiers, so a wildcard here can
+# never succeed. That makes it a configuration error, and it has to be caught
+# before the startup sequence below: past that point the container has generated
+# a placeholder certificate for a name that will never get a real one, started
+# haproxy serving it, and settled into retrying an unsatisfiable config forever.
+#
+# Fatal for the container rather than skipping the one domain. A mixed config
+# does contain the damage -- the other domains are issued normally -- but it
+# leaves a self-signed certificate served for the wildcard indefinitely and a
+# permanently failing loop, which reads as a TLS bug rather than a typo.
+reject_wildcards() {
+    local wildcards
+    wildcards=$(get-all-domains.sh | grep '^\*\.' || true)
+    [ -n "$wildcards" ] || return 0
+    echo "Error: tls-alpn-01 cannot issue wildcard certificates (RFC 8737)." >&2
+    echo "$wildcards" | sed 's/^/  /' >&2
+    echo "Use CHALLENGE_TYPE=dns-01 for wildcards, or list the names individually." >&2
+    exit 1
+}
+
 # What the gateway should route this hostname to.
 #
 # dns-01 uses the app id, so the gateway load-balances across every instance of
@@ -190,11 +210,9 @@ collect_evidence() {
 process_domain() {
     local domain="$1"
 
-    if [[ "$domain" == \*.* ]]; then
-        echo "Error: cannot issue a wildcard certificate for $domain with tls-alpn-01." >&2
-        echo "RFC 8737 forbids it; use CHALLENGE_TYPE=dns-01 for wildcards." >&2
-        exit 1
-    fi
+    # No wildcard check here: reject_wildcards has already refused to start over
+    # the same domain list, which cannot change while the container runs.
+    # legoman.py checks independently, guarding the ACME call itself.
 
     # Register the ACME account first so the CAA record we print can already
     # pin accounturi. Without this the operator would have to add CAA in a
@@ -303,6 +321,7 @@ cert_loop() {
     done
 }
 
+reject_wildcards
 setup_py_env
 check_lego
 load_dstack_identity