fix(dstack-ingress): make ACME_STAGING work in both modes, not just tls-alpn-01

ACME_STAGING was read only on the tls-alpn-01 path. Under dns-01 nothing
looked at it -- certman.py and functions.sh both read CERTBOT_STAGING --
so setting it there silently issued *production* certificates. The README
did not mark it mode-specific, so there was nothing to warn you.

Same shape as the RENEW_DAYS_BEFORE bug, and worse in effect: instead of
a knob that does nothing, this one does the opposite of what it says on a
path where the mistake costs a real certificate and real rate limit.

Normalise both names once in entrypoint.sh and export them. This does
belong there, unlike the wildcard rule: an ACME account and a staging
toggle are genuinely shared by both modes, which is exactly what that
file validates. The per-mode copies in dns01.sh and tlsalpn.sh are gone.

Name them after ACME rather than certbot throughout. What you configure
is an ACME account; which client implements a mode is an implementation
detail, and this image already changed it once. CERTBOT_EMAIL and
CERTBOT_STAGING keep working -- they are the historical names, not the
preferred ones, and the README no longer implies the preference depends
on the mode.

Also fixes the webhook example, which showed the payload's keys in an
order the code does not emit (it sorts them), and drops a stale duplicate
comment on ensure_placeholder_certs that credited certbot with forwarding
the tls-alpn-01 challenge.

Author: kvinwang

custom-domain/dstack-ingress/README.md

@@ -159,7 +159,7 @@ environment:
 | `DOMAIN` | Your domain (single-domain mode). Supports wildcards (`*.example.com`) |
 | `TARGET_ENDPOINT` | Backend address, e.g. `app:80` or `http://app:80` |
 | `GATEWAY_DOMAIN` | dstack gateway domain (e.g. `_.dstack-prod5.phala.network`) |
-| `CERTBOT_EMAIL` | *(optional)* ACME contact address. `ACME_EMAIL` is accepted too, and is the preferred name in tls-alpn-01 mode |
+| `ACME_EMAIL` | *(optional)* ACME contact address, in either mode. `CERTBOT_EMAIL` is the historical name and still works. See below — it is optional, and published |
 | `DNS_PROVIDER` | DNS provider (`cloudflare`, `linode`, `namecheap`) |
 
 ### Optional
@@ -171,8 +171,7 @@ environment:
 | `ROUTING_MAP` | | Multi-domain routing: `domain=host:port` per line |
 | `SET_CAA` | `false` | Enable CAA DNS record (dns-01 only; tls-alpn-01 cannot write DNS) |
 | `TXT_PREFIX` | `_dstack-app-address` | DNS TXT record prefix |
-| `CERTBOT_STAGING` | `false` | Use Let's Encrypt staging server. `ACME_STAGING` is the preferred name in tls-alpn-01 mode |
-| `ACME_EMAIL` | | ACME contact address, in either mode. Falls back to `CERTBOT_EMAIL`. Optional — see below |
+| `ACME_STAGING` | `false` | Use Let's Encrypt staging, in either mode. `CERTBOT_STAGING` is the historical name and still works |
 | `CHALLENGE_TYPE` | `dns-01` | `dns-01` (certbot + DNS credentials) or `tls-alpn-01` (lego, no DNS credentials) |
 | `DNS_SETUP_MODE` | `wait` | tls-alpn-01 only: `wait`, `print` or `webhook` — see below |
 | `DNS_SETUP_TIMEOUT` | `1800` | tls-alpn-01 only: seconds to wait for the records to appear |
@@ -345,7 +344,7 @@ Encrypt dropping expiry mail, and the container passes it for you.
 
 ```json
 {
-  "payload": "{\"version\":1,\"domain\":\"app.example.com\",\"records\":[...]}",
+  "payload": "{\"app_id\":\"…\",\"challenge\":\"tls-alpn-01\",\"domain\":\"app.example.com\",\"instance_id\":\"…\",\"records\":[…],\"timestamp\":1234567890,\"version\":1}",
   "hmac_sha256": "…",
   "attestation": { "quote": "…", "report_data": "…" }
 }

custom-domain/dstack-ingress/scripts/certman.py

@@ -13,6 +13,17 @@
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 
 
+def staging_enabled() -> bool:
+    """Whether to use Let's Encrypt staging.
+
+    entrypoint.sh normalises the two names, but certman.py is also runnable on
+    its own, so accept both here as well. ACME_STAGING wins: the setting is
+    about the ACME server, not about certbot.
+    """
+    value = os.environ.get("ACME_STAGING") or os.environ.get("CERTBOT_STAGING", "false")
+    return value == "true"
+
+
 class CertManager:
     """Certificate management using DNS provider infrastructure."""
 
@@ -299,7 +310,7 @@ def _build_certbot_command(self, action: str, domain: str, email: str) -> List[s
             else:
                 base_cmd.append("--register-unsafely-without-email")
             base_cmd.extend(["-d", domain])
-        if os.environ.get("CERTBOT_STAGING", "false") == "true":
+        if staging_enabled():
             base_cmd.extend(["--staging"])
 
         if getattr(self.provider, 'CERTBOT_PROPAGATION_SECONDS'):
@@ -513,7 +524,7 @@ def acme_account_exists(self) -> bool:
         """
         import glob
         api_endpoint = "acme-v02.api.letsencrypt.org"
-        if os.environ.get("CERTBOT_STAGING", "false") == "true":
+        if staging_enabled():
             api_endpoint = "acme-staging-v02.api.letsencrypt.org"
         pattern = f"/etc/letsencrypt/accounts/{api_endpoint}/directory/*/regr.json"
         return len(glob.glob(pattern)) > 0

custom-domain/dstack-ingress/scripts/dns01.sh

@@ -11,11 +11,9 @@ source /scripts/functions.sh
 source /scripts/haproxy-lib.sh
 source /scripts/evidence-lib.sh
 
-# ACME contact address. CERTBOT_EMAIL is the documented name on this path --
-# certbot really is the client here -- and ACME_EMAIL is accepted too so one
-# variable works in either mode. Optional either way.
-ACME_EMAIL=${ACME_EMAIL:-${CERTBOT_EMAIL:-}}
-export ACME_EMAIL
+# ACME_EMAIL / ACME_STAGING are normalised by entrypoint.sh and exported. The
+# contact address is optional; certman.py asks for a contactless account when
+# none is given.
 
 # certbot stores certificates under /etc/letsencrypt/live/<domain>/.
 cert_fullchain_path() { echo "/etc/letsencrypt/live/$(cert_dir_name "$1")/fullchain.pem"; }

custom-domain/dstack-ingress/scripts/entrypoint.sh

@@ -22,6 +22,19 @@ EVIDENCE_PORT=${EVIDENCE_PORT:-80}
 ALPN=${ALPN:-}
 CHALLENGE_TYPE=${CHALLENGE_TYPE:-dns-01}
 
+# ACME account settings, normalised once for both modes. What you are
+# configuring is an ACME account, not a particular client -- which client
+# implements a mode is an implementation detail, and this image already changed
+# it once (certbot for dns-01, lego for tls-alpn-01). So ACME_EMAIL and
+# ACME_STAGING are the names; CERTBOT_EMAIL and CERTBOT_STAGING are the
+# historical ones and keep working.
+#
+# Normalising here rather than per mode is what fixes the real bug: ACME_STAGING
+# used to be read only on the tls-alpn-01 path, so setting it under dns-01
+# silently issued *production* certificates.
+ACME_EMAIL=${ACME_EMAIL:-${CERTBOT_EMAIL:-}}
+ACME_STAGING=${ACME_STAGING:-${CERTBOT_STAGING:-false}}
+
 case "$CHALLENGE_TYPE" in
     dns-01|tls-alpn-01) ;;
     *)
@@ -72,6 +85,7 @@ done
 # the helpers it invokes see the sanitized values.
 export PORT DOMAIN DOMAINS TARGET_ENDPOINT ROUTING_MAP TXT_PREFIX MAXCONN
 export TIMEOUT_CONNECT TIMEOUT_CLIENT TIMEOUT_SERVER EVIDENCE_SERVER EVIDENCE_PORT ALPN
+export ACME_EMAIL ACME_STAGING
 
 case "$CHALLENGE_TYPE" in
     dns-01)

custom-domain/dstack-ingress/scripts/functions.sh

@@ -166,7 +166,8 @@ get_letsencrypt_account_path() {
     local base_path="/etc/letsencrypt/accounts"
     local api_endpoint="acme-v02.api.letsencrypt.org"
 
-    if [[ "$CERTBOT_STAGING" == "true" ]]; then
+    # entrypoint.sh normalises CERTBOT_STAGING into ACME_STAGING.
+    if [[ "$ACME_STAGING" == "true" ]]; then
         api_endpoint="acme-staging-v02.api.letsencrypt.org"
     fi
 

custom-domain/dstack-ingress/scripts/tlsalpn.sh

@@ -12,17 +12,13 @@ source /scripts/functions.sh
 source /scripts/haproxy-lib.sh
 source /scripts/evidence-lib.sh
 
-# ACME account settings. CERTBOT_EMAIL / CERTBOT_STAGING are the historical
-# names, kept working for anyone migrating a compose file from dns-01, but there
-# is no certbot on this path -- the ACME client here is lego.
+# ACME_EMAIL / ACME_STAGING are normalised by entrypoint.sh and exported, so
+# they are already correct here whichever name the operator used.
 #
 # The contact address is optional. RFC 8555 makes it optional, Let's Encrypt
 # stopped sending expiry notifications in 2025, and it does not stay private:
 # the account document is published at /evidences/acme-account.json, so an
 # address set here is readable by anyone who fetches the evidence.
-ACME_EMAIL=${ACME_EMAIL:-${CERTBOT_EMAIL:-}}
-ACME_STAGING=${ACME_STAGING:-${CERTBOT_STAGING:-false}}
-export ACME_EMAIL ACME_STAGING
 
 LEGO_BIN=${LEGO_BIN:-/usr/local/bin/lego}
 LEGO_PATH=${LEGO_PATH:-/etc/letsencrypt/lego}
@@ -148,10 +144,6 @@ EOF
 # haproxy refuses to start when the crt directory has no PEM in it, and here it
 # has to be listening before the first certificate can exist -- it is what
 # forwards the challenge to lego. Seed a placeholder the real cert overwrites.
-# haproxy refuses to start when the crt directory has no PEM in it. In
-# tls-alpn-01 mode the proxy has to be listening *before* the first certificate
-# exists, because it is what forwards the ACME challenge to certbot, so seed a
-# self-signed placeholder that the real certificate overwrites later.
 ensure_placeholder_certs() {
     local all_domains domain pem
     all_domains=$(get-all-domains.sh)