fix(dstack-ingress): carry the #104 challenge delegation through the restructure

#104 added ACME DNS-01 challenge delegation to entrypoint.sh. This branch
moves that file's logic into dns01.sh, so a plain rebase drops the shell
half of it: set_alias_record / set_txt_record / set_caa_record kept this
branch's versions and the delegation branches went with them.

Port them into dns01.sh, which is where the delegation belongs anyway --
it is a dns-01 capability, and entrypoint.sh no longer holds mode-specific
logic. Everything else from #104 survived the rebase untouched: the hook
script, unset_txt_record, the dnsman.py action, the certman.py branch and
the README section.

Two of the ports are deliberate substitutions, not copies:

- The CAA helpers reuse this branch's caa_tag_for() and "${domain#\*.}"
  instead of re-introducing caa_domain_and_tag(). Behaviour is identical
  for both wildcard and plain names; the second helper would only be a
  second place to keep them in sync.

- The delegated TXT instruction prints $(txt_record_value) rather than
  "$APP_ID:$PORT". APP_ID is an optional override, so the original printed
  ":443" whenever it was unset -- which is the common case. Printing the
  same function that writes the record in non-delegation mode also stops
  the instruction drifting from what the gateway actually expects.

Two more changes are integration fixes: bugs neither PR has alone, only
the combination.

- The delegation branch built its certbot command with CERTBOT_STAGING,
  which this branch renamed to ACME_STAGING. ACME_STAGING=true plus
  delegation would have issued *production* certificates.

- It also passed --email unconditionally, which this branch made optional;
  with no contact address configured that is `--email ""`. It now uses the
  same optional-contact handling as the plugin path.

Verified against a delegation run: the served zone is untouched, all four
static records print with correct values, the certbot command carries
--manual with both hooks plus --staging and
--register-unsafely-without-email, CAA verification fails closed with
exit 1, and ALLOW_MISSING_CAA=true overrides it.

Author: kvinwang

custom-domain/dstack-ingress/scripts/certman.py

@@ -293,12 +293,17 @@ def _build_certbot_command(self, action: str, domain: str, email: str) -> List[s
                     f"--manual-auth-hook={hook} auth",
                     f"--manual-cleanup-hook={hook} cleanup",
                     "--agree-tos", "--no-eff-email",
-                    "--email", email, "-d", domain,
                 ])
+                # Same optional-contact handling as the plugin path below.
+                if email:
+                    base_cmd.extend(["--email", email])
+                else:
+                    base_cmd.append("--register-unsafely-without-email")
+                base_cmd.extend(["-d", domain])
             # For `renew`, certbot reuses the authenticator + hooks saved in the
             # renewal config from the initial `certonly`, so we don't re-specify
             # them here (and must not fall back to the DNS plugin).
-            if os.environ.get("CERTBOT_STAGING", "false") == "true":
+            if staging_enabled():
                 base_cmd.append("--staging")
             masked = [a if not (i > 0 and base_cmd[i - 1] == "--email") else "<email>"
                       for i, a in enumerate(base_cmd)]

custom-domain/dstack-ingress/scripts/dns01.sh

@@ -76,6 +76,16 @@ EOF
 
 set_alias_record() {
     local domain="$1"
+    if [ -n "${ACME_CHALLENGE_ALIAS:-}" ]; then
+        # certbot validates the challenge at the base name even for a wildcard,
+        # so the _acme-challenge CNAME must use the base domain (strip "*.").
+        local base="${domain#\*.}"
+        echo "[challenge-delegation] Not touching ${domain}'s own zone (token is scoped to the delegated zone)."
+        echo "[challenge-delegation] Set these in your production zone yourself (static, one-time):"
+        echo "    ${domain}  CNAME  ${GATEWAY_DOMAIN}"
+        echo "    _acme-challenge.${base}  CNAME  _acme-challenge.${base}.${ACME_CHALLENGE_ALIAS}"
+        return
+    fi
     echo "Setting alias record for $domain"
     dnsman.py set_alias \
         --domain "$domain" \
@@ -95,6 +105,12 @@ set_txt_record() {
     local txt_domain
     txt_domain=$(txt_record_name "$domain")
 
+    if [ -n "${ACME_CHALLENGE_ALIAS:-}" ]; then
+        echo "[challenge-delegation] Set this in your production zone yourself (static, one-time):"
+        echo "    ${txt_domain}  TXT  \"$(txt_record_value)\""
+        return
+    fi
+
     dnsman.py set_txt \
         --domain "$txt_domain" \
         --content "$(txt_record_value)"
@@ -105,8 +121,73 @@ set_txt_record() {
     fi
 }
 
+# In delegation mode we have NO token for the served domain's zone, so we cannot
+# set the accounturi CAA ourselves. That CAA is the forge-prevention (only this
+# enclave's ACME account may issue), so this path is deliberately NOT gated by
+# SET_CAA and fails closed if the record is confirmed absent -- otherwise anyone
+# who can satisfy the delegated DNS-01 challenge could obtain a cert for the
+# domain. Set ALLOW_MISSING_CAA=true to override (accept the risk).
+verify_delegation_caa() {
+    local domain="$1"
+    local account_file account_uri caa_domain caa_tag caa_value resp status found
+
+    if ! account_file=$(get_letsencrypt_account_file); then
+        echo "ERROR: cannot read the Let's Encrypt account file to determine the required accounturi CAA" >&2
+        caa_fail_or_allow "$domain"
+        return
+    fi
+    caa_domain="${domain#\*.}"
+    caa_tag=$(caa_tag_for "$domain")
+    account_uri=$(jq -j '.uri' "$account_file")
+    caa_value="letsencrypt.org;validationmethods=dns-01;accounturi=$account_uri"
+
+    echo "[challenge-delegation] Set this CAA in your production zone (static, one-time):"
+    echo "    ${caa_domain}  CAA  0 ${caa_tag} \"${caa_value}\""
+
+    # Verify via DNS-over-HTTPS (dig is not installed in the image; curl+jq are).
+    resp=$(curl -s --max-time 10 "https://dns.google/resolve?name=${caa_domain}&type=257" 2>/dev/null || true)
+    if [ -z "$resp" ]; then
+        echo "WARNING: could not reach dns.google to verify the CAA (network issue) — NOT confirmed; continuing"
+        return
+    fi
+    status=$(echo "$resp" | jq -r '.Status // empty' 2>/dev/null || true)
+    if [ "$status" != "0" ]; then
+        echo "WARNING: CAA DoH query for ${caa_domain} returned status ${status:-unknown} — NOT confirmed; continuing"
+        return
+    fi
+    # Literal (grep -F) match on the CAA data fields — the account URI contains
+    # '/' and '.', which must not be treated as regex.
+    found=$(echo "$resp" | jq -r '.Answer // [] | .[] | .data' 2>/dev/null | grep -F "accounturi=$account_uri" || true)
+    if [ -n "$found" ]; then
+        echo "[challenge-delegation] Verified: accounturi CAA is present for $caa_domain"
+        return
+    fi
+    echo "ERROR: the accounturi CAA is NOT present for $caa_domain." >&2
+    echo "ERROR: without it, anyone who can satisfy the delegated DNS-01 challenge could obtain a" >&2
+    echo "ERROR: publicly-trusted certificate for this domain (forged TLS termination)." >&2
+    caa_fail_or_allow "$domain"
+}
+
+caa_fail_or_allow() {
+    local domain="$1"
+    if [ "${ALLOW_MISSING_CAA:-false}" = "true" ]; then
+        echo "WARNING: ALLOW_MISSING_CAA=true — continuing without a verified accounturi CAA for $domain"
+        return 0
+    fi
+    echo "ERROR: refusing to continue without the accounturi CAA for $domain." >&2
+    echo "ERROR: set the CAA record shown above, or ALLOW_MISSING_CAA=true to override." >&2
+    exit 1
+}
+
 set_caa_record() {
     local domain="$1"
+
+    # Delegation mode is handled separately and is NOT gated by SET_CAA.
+    if [ -n "${ACME_CHALLENGE_ALIAS:-}" ]; then
+        verify_delegation_caa "$domain"
+        return
+    fi
+
     if [ "$SET_CAA" != "true" ]; then
         echo "Skipping CAA record setup"
         return