docs(dstack-ingress): name the ACME account settings after ACME, not certbot

Author: Kevin Wang

custom-domain/dstack-ingress/README.md

@@ -159,7 +159,7 @@ environment:
 | `DOMAIN` | Your domain (single-domain mode). Supports wildcards (`*.example.com`) |
 | `TARGET_ENDPOINT` | Backend address, e.g. `app:80` or `http://app:80` |
 | `GATEWAY_DOMAIN` | dstack gateway domain (e.g. `_.dstack-prod5.phala.network`) |
-| `CERTBOT_EMAIL` | Email for Let's Encrypt registration |
+| `CERTBOT_EMAIL` | Email for Let's Encrypt registration. In tls-alpn-01 mode the preferred name is `ACME_EMAIL` |
 | `DNS_PROVIDER` | DNS provider (`cloudflare`, `linode`, `namecheap`) |
 
 ### Optional
@@ -171,7 +171,8 @@ environment:
 | `ROUTING_MAP` | | Multi-domain routing: `domain=host:port` per line |
 | `SET_CAA` | `false` | Enable CAA DNS record (dns-01 only; tls-alpn-01 cannot write DNS) |
 | `TXT_PREFIX` | `_dstack-app-address` | DNS TXT record prefix |
-| `CERTBOT_STAGING` | `false` | Use Let's Encrypt staging server |
+| `CERTBOT_STAGING` | `false` | Use Let's Encrypt staging server. `ACME_STAGING` is the preferred name in tls-alpn-01 mode |
+| `ACME_EMAIL` | | ACME account email in tls-alpn-01 mode. Falls back to `CERTBOT_EMAIL`; there is no certbot on that path |
 | `CHALLENGE_TYPE` | `dns-01` | `dns-01` (certbot + DNS credentials) or `tls-alpn-01` (lego, no DNS credentials) |
 | `DNS_SETUP_MODE` | `wait` | tls-alpn-01 only: `wait`, `print` or `webhook` — see below |
 | `DNS_SETUP_TIMEOUT` | `1800` | tls-alpn-01 only: seconds to wait for the records to appear |
@@ -253,8 +254,10 @@ services:
       - CHALLENGE_TYPE=tls-alpn-01
       - DOMAIN=app.example.com
       - TARGET_ENDPOINT=http://app:80
+      # Printed as the CNAME target, and used to verify that the hostname
+      # really resolves to the gateway before issuance starts.
       - GATEWAY_DOMAIN=_.dstack-prod5.phala.network
-      - CERTBOT_EMAIL=you@example.com
+      - ACME_EMAIL=you@example.com
       # - DNS_SETUP_MODE=wait          # default; blocks until the records exist
     ports:
       - "443:443"

custom-domain/dstack-ingress/scripts/legoman.py

@@ -47,9 +47,10 @@
 
 
 def acme_server() -> str:
-    if os.environ.get("CERTBOT_STAGING", "false") == "true":
-        return ACME_STAGING
-    return ACME_PROD
+    # CERTBOT_STAGING is the historical name and still works, but there is no
+    # certbot on this path: the ACME client here is lego.
+    staging = os.environ.get("ACME_STAGING") or os.environ.get("CERTBOT_STAGING", "false")
+    return ACME_STAGING if staging == "true" else ACME_PROD
 
 
 def server_dir() -> str:
@@ -210,11 +211,11 @@ def main() -> int:
     parser.add_argument("--email", help="Email for ACME registration")
     args = parser.parse_args()
 
-    email = args.email or os.environ.get("CERTBOT_EMAIL", "")
+    email = args.email or os.environ.get("ACME_EMAIL") or os.environ.get("CERTBOT_EMAIL", "")
 
     if args.action == "account-uri":
         if not email:
-            print("Error: --email or CERTBOT_EMAIL is required", file=sys.stderr)
+            print("Error: --email or ACME_EMAIL is required", file=sys.stderr)
             return EXIT_ERROR
         uri = account_uri(email)
         if not uri:
@@ -231,7 +232,7 @@ def main() -> int:
         return EXIT_CHANGED
 
     if not email:
-        print("Error: --email or CERTBOT_EMAIL is required", file=sys.stderr)
+        print("Error: --email or ACME_EMAIL is required", file=sys.stderr)
         return EXIT_ERROR
     if not os.path.isfile(LEGO_BIN):
         print(f"Error: lego binary not found at {LEGO_BIN}", file=sys.stderr)

custom-domain/dstack-ingress/scripts/tlsalpn.sh

@@ -12,6 +12,18 @@ source /scripts/functions.sh
 source /scripts/haproxy-lib.sh
 source /scripts/evidence-lib.sh
 
+# ACME account settings. CERTBOT_EMAIL / CERTBOT_STAGING are the historical
+# names, kept working for anyone migrating a compose file from dns-01, but there
+# is no certbot on this path -- the ACME client here is lego.
+ACME_EMAIL=${ACME_EMAIL:-${CERTBOT_EMAIL:-}}
+ACME_STAGING=${ACME_STAGING:-${CERTBOT_STAGING:-false}}
+export ACME_EMAIL ACME_STAGING
+
+if [ -z "$ACME_EMAIL" ]; then
+    echo "Error: ACME_EMAIL must be set (CERTBOT_EMAIL is accepted as an alias)" >&2
+    exit 1
+fi
+
 LEGO_BIN=${LEGO_BIN:-/usr/local/bin/lego}
 LEGO_PATH=${LEGO_PATH:-/etc/letsencrypt/lego}
 TLSALPN_ADDRESS=${TLSALPN_ADDRESS:-127.0.0.1}
@@ -182,13 +194,13 @@ process_domain() {
     # Register the ACME account first so the CAA record we print can already
     # pin accounturi. Without this the operator would have to add CAA in a
     # second pass, after the account exists.
-    if ! legoman.py register --email "$CERTBOT_EMAIL"; then
+    if ! legoman.py register --email "$ACME_EMAIL"; then
         echo "Error: failed to register the ACME account" >&2
         exit 1
     fi
 
     local account_uri caa_value
-    account_uri=$(legoman.py account-uri --email "$CERTBOT_EMAIL" 2>/dev/null || true)
+    account_uri=$(legoman.py account-uri --email "$ACME_EMAIL" 2>/dev/null || true)
     if [ -n "$account_uri" ]; then
         caa_value="letsencrypt.org;validationmethods=tls-alpn-01;accounturi=$account_uri"
     else
@@ -232,7 +244,7 @@ process_domain() {
         sleep "${DNS_SETTLE_SECONDS}"
     fi
 
-    legoman.py auto --domain "$domain" --email "$CERTBOT_EMAIL"
+    legoman.py auto --domain "$domain" --email "$ACME_EMAIL"
 }
 
 # One pass over every domain: make sure the records exist, then issue or renew.