refactor(dstack-ingress): name the delegation zone after what it now is

ACME_CHALLENGE_ALIAS was accurate when the challenge was the only thing
delegated. It now decides the target of four records -- the gateway
pointer, the app-address TXT, the challenge TXT and the CAA -- so it is
the delegation zone, and DELEGATION_ZONE is what it is called. It also
lines up with DELEGATION_GATEWAY_RECORD.

The old name still works. Each program that can be invoked on its own
resolves both, rather than relying on a caller to normalise: certbot runs
the challenge hook as a fresh process, and dnsguide.py and certman.py are
runnable standalone.

Also document that a wildcard and its base name share a delegated target
-- both *.example.com and example.com map to example.com.<zone>. One
deployment serving both publishes the same values twice and is fine; two
deployments with different gateways need separate zones.

Author: kvinwang

custom-domain/dstack-ingress/README.md

@@ -191,7 +191,7 @@ environment:
 | `EVIDENCE_SERVER` | `true` | Serve evidence files at `/evidences/` on the TLS port |
 | `EVIDENCE_PORT` | `80` | Internal port for evidence HTTP server |
 | `ALPN` | | TLS ALPN protocols (e.g. `h2,http/1.1`). Only set if backends support h2c |
-| `ACME_CHALLENGE_ALIAS` | | Delegate the ACME DNS-01 challenge to this zone (see below) so the DNS token needs no access to the served domain's own zone |
+| `DELEGATION_ZONE` | | Zone this container writes into, so the DNS token needs no access to the served domain's own zone (see below). `ACME_CHALLENGE_ALIAS` is the original name and still works |
 | `ACME_CHALLENGE_PROPAGATION_SECONDS` | `120` | Wait after writing the delegated challenge TXT before validation. Must outlast the record TTL (60s), or a resolver still serving the previous attempt's value fails validation. Keep well under ~250s — certbot is killed after a 300s per-run timeout |
 | `DELEGATION_GATEWAY_RECORD` | `cname` | How the delegated name points at the gateway: `cname` (follows a gateway that moves) or `a` (for providers that refuse a CAA beside a CNAME) |
 | `ALLOW_MISSING_CAA` | `false` | In delegation mode, treat an unconfirmed `accounturi` CAA as a warning instead of a blocker. Default fails closed (see below) |
@@ -206,7 +206,7 @@ served name lives under a shared production zone (e.g. `svc.example.com` under
 `example.com`), that token can edit every record in the zone, which may be more
 privilege than you want.
 
-Set `ACME_CHALLENGE_ALIAS=<delegation-zone>` to move every name this deployment
+Set `DELEGATION_ZONE=<delegation-zone>` to move every name this deployment
 needs into a zone your token controls. You create three CNAMEs in the served
 domain's zone **once, before deploying**, and then never touch DNS again — not
 when the app id changes with the compose, not when the ACME account is
@@ -240,6 +240,11 @@ itself and publishes an address record, which can carry the CAA. The cost is
 that a gateway which moves is then only picked up on the next pass, where a
 CNAME follows it immediately.
 
+A wildcard and its base name share a delegated target: both `*.example.com` and
+`example.com` map to `example.com.<delegation-zone>`. One deployment serving both
+is fine, since it publishes the same values twice. Two deployments pointing at
+different gateways are not — give them separate delegation zones.
+
 **Wildcards keep an operator-managed CAA.** RFC 8659 evaluates `*.example.com`
 at `example.com`, which is your own name and cannot be aliased away, so for a
 wildcard the container prints the CAA and verifies it rather than publishing it.

custom-domain/dstack-ingress/TESTING.md

@@ -201,13 +201,13 @@ first issuance.
 
 ### Challenge delegation (dns-01)
 
-`ACME_CHALLENGE_ALIAS` answers the DNS-01 challenge in a zone the container's
+`DELEGATION_ZONE` answers the DNS-01 challenge in a zone the container's
 token controls, so the token needs no access to the served domain's own zone.
 Testing it looks like it needs a second registrar account. It does not.
 
 Any name under a zone you already control works as the delegation zone, because
 the provider resolves a zone by longest-suffix match on the record name. With
-`ACME_CHALLENGE_ALIAS=deleg.example.com` and a served domain of
+`DELEGATION_ZONE=deleg.example.com` and a served domain of
 `svc.example.com`, the challenge record is
 `_acme-challenge.svc.example.com.deleg.example.com`, which lands in
 `example.com` — the same zone, but through the delegation code path.

custom-domain/dstack-ingress/scripts/acme-dns-alias-hook.sh

@@ -3,10 +3,10 @@
 #
 # Instead of writing the `_acme-challenge` TXT into the served domain's own
 # zone (which requires a DNS token for that zone), this writes it into a
-# delegated zone that our token controls (ACME_CHALLENGE_ALIAS). The served
+# delegated zone that our token controls (DELEGATION_ZONE). The served
 # domain's zone only needs one static, operator-managed CNAME:
 #
-#   _acme-challenge.<domain>  CNAME  _acme-challenge.<domain>.<ACME_CHALLENGE_ALIAS>
+#   _acme-challenge.<domain>  CNAME  _acme-challenge.<domain>.<DELEGATION_ZONE>
 #
 # Let's Encrypt follows that CNAME during validation and reads the TXT from the
 # delegated zone, so the enclave's token never needs access to the served
@@ -18,8 +18,12 @@ set -euo pipefail
 
 action="${1:-}"
 
-if [ -z "${ACME_CHALLENGE_ALIAS:-}" ]; then
-    echo "acme-dns-alias-hook: ACME_CHALLENGE_ALIAS is not set" >&2
+# DELEGATION_ZONE is the current name; ACME_CHALLENGE_ALIAS is the original one
+# and still works. certbot runs this as a fresh process, so resolve both here
+# rather than relying on the caller.
+zone="${DELEGATION_ZONE:-${ACME_CHALLENGE_ALIAS:-}}"
+if [ -z "$zone" ]; then
+    echo "acme-dns-alias-hook: DELEGATION_ZONE is not set" >&2
     exit 1
 fi
 if [ -z "${CERTBOT_DOMAIN:-}" ]; then
@@ -28,7 +32,7 @@ if [ -z "${CERTBOT_DOMAIN:-}" ]; then
 fi
 
 # certbot always passes the base domain (no leading "*.") in CERTBOT_DOMAIN.
-record="_acme-challenge.${CERTBOT_DOMAIN}.${ACME_CHALLENGE_ALIAS}"
+record="_acme-challenge.${CERTBOT_DOMAIN}.${zone}"
 
 case "$action" in
     auth)

custom-domain/dstack-ingress/scripts/certman.py

@@ -279,11 +279,11 @@ def _build_certbot_command(self, action: str, domain: str, email: str) -> List[s
         """Build certbot command using provider configuration."""
         certbot_cmd = self._get_certbot_command()
 
-        # Challenge-delegation mode: when ACME_CHALLENGE_ALIAS is set, answer the
+        # Challenge-delegation mode: when DELEGATION_ZONE is set, answer the
         # DNS-01 challenge in a delegated zone via a manual hook instead of the
         # provider's certbot plugin, so our DNS token never needs access to the
         # served domain's own zone. See scripts/acme-dns-alias-hook.sh.
-        if os.environ.get("ACME_CHALLENGE_ALIAS", "").strip():
+        if os.environ.get("DELEGATION_ZONE", "").strip() or os.environ.get("ACME_CHALLENGE_ALIAS", "").strip():
             hook = "/scripts/acme-dns-alias-hook.sh"
             base_cmd = certbot_cmd + [action, "--non-interactive", "-v"]
             if action == "certonly":

custom-domain/dstack-ingress/scripts/dns01.sh

@@ -11,6 +11,13 @@ source /scripts/functions.sh
 source /scripts/haproxy-lib.sh
 source /scripts/evidence-lib.sh
 
+# The zone this container writes into. ACME_CHALLENGE_ALIAS was the original
+# name, from when the challenge was the only thing delegated; it now decides the
+# target of every record, so DELEGATION_ZONE is what it is called. The old name
+# still works.
+DELEGATION_ZONE=${DELEGATION_ZONE:-${DELEGATION_ZONE:-}}
+export DELEGATION_ZONE
+
 # ACME_EMAIL / ACME_STAGING are normalised by entrypoint.sh and exported. The
 # contact address is optional; certman.py asks for a contactless account when
 # none is given.
@@ -121,7 +128,7 @@ set_txt_record() {
 # reject the CAA here; see DELEGATION_GATEWAY_RECORD.
 delegated_name() {
     local domain="${1#\*.}"
-    echo "${domain}.${ACME_CHALLENGE_ALIAS}"
+    echo "${domain}.${DELEGATION_ZONE}"
 }
 
 delegation_publish() {
@@ -151,7 +158,7 @@ delegation_publish() {
             ;;
     esac
 
-    txt_name="$(txt_record_name "$domain").${ACME_CHALLENGE_ALIAS}"
+    txt_name="$(txt_record_name "$domain").${DELEGATION_ZONE}"
     dnsman.py set_txt --domain "$txt_name" --content "$(txt_record_value)" || return 1
 }
 
@@ -195,7 +202,7 @@ delegation_guide() {
         --caa-name "$caa_domain" \
         --caa-tag "$caa_tag" \
         --challenge dns-01 \
-        --challenge-alias "$ACME_CHALLENGE_ALIAS" \
+        --challenge-alias "$DELEGATION_ZONE" \
         --mode "${DNS_SETUP_MODE:-wait}" \
         --include "$include" \
         "$@"
@@ -231,7 +238,7 @@ set_caa_record() {
     # Delegation is deliberately NOT gated by SET_CAA: this record is the only
     # thing stopping anyone else who can satisfy the delegated challenge, so it
     # is not optional here.
-    if [ -n "${ACME_CHALLENGE_ALIAS:-}" ]; then
+    if [ -n "${DELEGATION_ZONE:-}" ]; then
         delegation_publish_caa "$domain"
         case $? in
             0) return ;;
@@ -280,7 +287,7 @@ set_caa_record() {
 process_domain() {
     local domain="$1" first status
 
-    if [ -n "${ACME_CHALLENGE_ALIAS:-}" ]; then
+    if [ -n "${DELEGATION_ZONE:-}" ]; then
         # Delegation: the operator created three CNAMEs once, before deploying.
         # Everything they point at is published here. Which of them block
         # depends on the pass.
@@ -297,7 +304,7 @@ process_domain() {
         # Publish first: the aliases the operator created point at names that
         # have to exist before checking them proves anything.
         if ! delegation_publish "$domain"; then
-            echo "Error: could not publish $domain into $ACME_CHALLENGE_ALIAS" >&2
+            echo "Error: could not publish $domain into $DELEGATION_ZONE" >&2
             return 1
         fi
         local want=challenge-cname

custom-domain/dstack-ingress/scripts/dnsguide.py

@@ -470,7 +470,7 @@ def main() -> int:
     parser.add_argument("--challenge", default="tls-alpn-01")
     parser.add_argument(
         "--challenge-alias",
-        default=os.environ.get("ACME_CHALLENGE_ALIAS", ""),
+        default=os.environ.get("DELEGATION_ZONE", os.environ.get("ACME_CHALLENGE_ALIAS", "")),
         help="delegation zone for the _acme-challenge CNAME (dns-01 delegation)",
     )
     parser.add_argument(