refactor(dstack-ingress): let the provider choose the gateway record, as it already did

DELEGATION_GATEWAY_RECORD reimplemented an extension point that was
already there. set_alias_record means "point this name at that target, in
whatever form this provider allows beside a CAA" -- Linode overrides it to
publish an address record, with a docstring saying exactly why: it refuses
a CAA next to a CNAME, which is the conflict delegation runs into.

So there were two mechanisms deciding the same thing: the per-provider
override, and a `case cloudflare) cname ;; *) a ;;` of my own a layer up.
They agreed on Linode by coincidence and would have disagreed on any
provider that added an override later, since the shell branch never
consulted it.

Worse, the previous commit made the `cname` branch call set_cname
specifically to bypass Linode's override -- treating the correct
provider-specific behaviour as the bug.

Delegation now asks for an alias and takes what it gets. Gone with the
switch: the provider-detection action, the set_a action, dnsguide's
--resolve, and the README section explaining which providers get which.
A provider that needs a form other than CNAME overrides set_alias_record,
which is one place to look instead of two.

The cross-type clearing that review found stays, moved to where it
belongs: set_alias_record removes address records before writing a CNAME,
Linode's override removes a CNAME before writing an address record. Every
caller benefits, not just delegation, and the rule sits next to the
knowledge of which form this provider uses.

Route53 is worth a look separately -- it takes the base CNAME path, and
if it also refuses a CAA beside a CNAME it needs the same override Linode
has. Untested either way.

Author: kvinwang

custom-domain/dstack-ingress/README.md

@@ -193,7 +193,6 @@ environment:
 | `ALPN` | | TLS ALPN protocols (e.g. `h2,http/1.1`). Only set if backends support h2c |
 | `DELEGATION_ZONE` | | Zone this container writes into, so the DNS token needs no access to the served domain's own zone (see below) |
 | `DELEGATION_PROPAGATION_SECONDS` | `120` | Wait after writing the delegated challenge TXT before validation. Must outlast the record TTL (60s), or a resolver still serving the previous attempt's value fails validation. Keep well under ~250s — certbot is killed after a 300s per-run timeout |
-| `DELEGATION_GATEWAY_RECORD` | per provider | How the delegated name points at the gateway: `cname` (Cloudflare default; follows a gateway that moves) or `a` (default elsewhere, for providers that refuse a CAA beside a CNAME) |
 
 For DNS provider credentials, see [DNS_PROVIDERS.md](DNS_PROVIDERS.md).
 
@@ -232,29 +231,12 @@ _dstack-app-address.svc.example.com.deleg.example.net  TXT    "<app-id>:<port>"
 _acme-challenge.svc.example.com.deleg.example.net      TXT    <challenge>   (transient)
 ```
 
-The gateway pointer and the CAA share a name, which RFC 1034 does not allow —
-a CNAME excludes every other type at its name. **Cloudflare allows the pair
-anyway**, and Let's Encrypt honours the CAA it finds there: with a CAA that
-forbids it, the staging CA refuses with `While processing CAA for
-svc.example.com: CAA record for svc.example.com prevents issuance`.
-
-Providers that enforce the standard will reject the CAA beside the CNAME, so
-they get an address record instead — `A` and `CAA` coexist legally. The default
-follows the provider:
-
-| Provider | Gateway pointer | Gateway that moves |
-|---|---|---|
-| `cloudflare` | `CNAME` to `GATEWAY_DOMAIN` | followed by DNS, immediately |
-| everything else | `A`, re-resolved each pass | picked up within `RENEW_INTERVAL` |
-
-`DELEGATION_GATEWAY_RECORD=cname\|a` overrides it. Only Cloudflare has been
-tested; if another provider accepts a CAA beside a CNAME, setting `cname` there
-gets the better behaviour.
-
-A wildcard and its base name share a delegated target: both `*.example.com` and
-`example.com` map to `example.com.<delegation-zone>`. One deployment serving both
-is fine, since it publishes the same values twice. Two deployments pointing at
-different gateways are not — give them separate delegation zones.
+The gateway pointer and the CAA share a name, which DNS does not allow for a
+CNAME. Which form works is a property of the provider — Cloudflare tolerates the
+pair, Linode publishes an address record instead — and `set_alias_record` in the
+provider layer is where that choice is made. Delegation asks for an alias and
+takes what it gets. A provider that needs a form other than CNAME overrides that
+method, as Linode does.
 
 **A wildcard needs a fourth CNAME.** RFC 8659 evaluates `*.app.example.com` at
 `app.example.com`, so the base gets its own alias and the container publishes an

custom-domain/dstack-ingress/scripts/dns01.sh

@@ -116,29 +116,10 @@ set_txt_record() {
 # never needs touching again -- not when the app id changes with the compose,
 # not when the ACME account is recreated, not when the gateway moves.
 #
-# How the delegated name points at the gateway.
-#
-# A CNAME is better -- a gateway that moves is followed automatically -- but the
-# same name also has to carry the CAA, and RFC 1034 says a CNAME excludes every
-# other type at its name. Cloudflare allows the pair anyway, and Let's Encrypt
-# honours the CAA it finds there (verified against the staging CA). Providers
-# that enforce the standard reject it, so they get an address record instead:
-# A and CAA coexist legally, at the cost of re-resolving GATEWAY_DOMAIN once a
-# pass rather than letting DNS follow it.
-#
-# Default per provider, since only Cloudflare is known to allow the pair.
-# DELEGATION_GATEWAY_RECORD overrides it either way.
-delegation_gateway_record() {
-    if [ -n "${DELEGATION_GATEWAY_RECORD:-}" ]; then
-        echo "$DELEGATION_GATEWAY_RECORD"
-        return
-    fi
-    case "$(dnsman.py provider 2>/dev/null)" in
-        cloudflare) echo cname ;;
-        *) echo a ;;
-    esac
-}
-
+# The gateway pointer and the CAA end up on one name, which DNS does not allow
+# for a CNAME. Which form works is a provider property -- Cloudflare tolerates
+# the pair, Linode publishes an address record instead -- and set_alias_record
+# is where that knowledge lives, so ask for an alias and let the provider pick.
 delegated_name() {
     local domain="${1#\*.}"
     echo "${domain}.${DELEGATION_ZONE}"
@@ -148,37 +129,7 @@ delegation_publish() {
     local domain="$1" target txt_name
     target=$(delegated_name "$domain")
 
-    # The set_* helpers only look at the type they are about to write, so a
-    # leftover record of the other type stays and blocks the new one -- DNS
-    # forbids a CNAME beside anything else. Clear it first, so switching
-    # DELEGATION_GATEWAY_RECORD either way actually takes effect.
-    case "$(delegation_gateway_record)" in
-        cname)
-            dnsman.py unset --domain "$target" --type A >/dev/null 2>&1 || true
-            # set_cname, not set_alias: some providers redefine "alias" to mean
-            # an address record (Linode does, precisely to dodge the CAA/CNAME
-            # conflict), and this branch has to mean what it says.
-            dnsman.py set_cname --domain "$target" --content "$GATEWAY_DOMAIN" || return 1
-            ;;
-        a)
-            # For providers that refuse a CAA beside a CNAME. Costs the
-            # automatic following of a gateway that moves: the address is
-            # re-resolved once per pass instead.
-            local addrs addr
-            addrs=$(dnsguide.py --resolve "$GATEWAY_DOMAIN" 2>/dev/null)
-            if [ -z "$addrs" ]; then
-                echo "Error: could not resolve $GATEWAY_DOMAIN to any address" >&2
-                return 1
-            fi
-            addr=$(echo "$addrs" | head -1)
-            dnsman.py unset --domain "$target" --type CNAME >/dev/null 2>&1 || true
-            dnsman.py set_a --domain "$target" --content "$addr" || return 1
-            ;;
-        *)
-            echo "Error: invalid DELEGATION_GATEWAY_RECORD (expected cname or a)" >&2
-            return 1
-            ;;
-    esac
+    dnsman.py set_alias --domain "$target" --content "$GATEWAY_DOMAIN" || return 1
 
     txt_name="$(txt_record_name "$domain").${DELEGATION_ZONE}"
     dnsman.py set_txt --domain "$txt_name" --content "$(txt_record_value)" || return 1

custom-domain/dstack-ingress/scripts/dns_providers/base.py

@@ -160,27 +160,40 @@ def set_a_record(
         )
         return self.create_dns_record(new_record)
 
+    def clear_conflicting_alias(self, name: str, keep: "RecordType") -> None:
+        """Remove address/alias records at `name` other than `keep`.
+
+        DNS forbids a CNAME beside anything else, and the set_* helpers only
+        look at the type they are about to write, so a name that already holds
+        the other form blocks the write. That happens whenever the form changes
+        -- a provider gaining an override, or a deployment moving between
+        providers -- and the failure looks like a permissions problem rather
+        than a leftover record.
+        """
+        for record_type in (RecordType.CNAME, RecordType.A, RecordType.AAAA):
+            if record_type == keep:
+                continue
+            for record in self.get_dns_records(name, record_type):
+                if record.id:
+                    self.delete_dns_record(record.id, name)
+
     def set_alias_record(
         self,
         name: str,
         content: str,
         ttl: int = 60,
         proxied: bool = False,
     ) -> bool:
-        """Set an alias record (delete existing and create new).
-
-        Creates a CNAME record by default. Some providers may override this
-        to use A records instead (e.g., Linode to avoid CAA conflicts).
+        """Point `name` at `content`, in whatever form this provider allows.
 
-        Args:
-            name: The record name
-            content: The alias target (domain name)
-            ttl: Time to live
-            proxied: Whether to proxy through provider (if supported)
+        A CNAME by default. Providers override this where a CNAME will not do
+        -- Linode publishes an address record instead, because it refuses a CAA
+        beside a CNAME, and delegation needs both on one name.
 
-        Returns:
-            True if successful, False otherwise
+        Callers should not second-guess the form: which one works is a property
+        of the provider, and this is where that knowledge lives.
         """
+        self.clear_conflicting_alias(name, RecordType.CNAME)
         return self.set_cname_record(name, content, ttl, proxied)
 
     def set_cname_record(

custom-domain/dstack-ingress/scripts/dns_providers/linode.py

@@ -292,6 +292,7 @@ def set_alias_record(
         """
         # Resolve domain to IP
         domain = content
+        self.clear_conflicting_alias(name, RecordType.A)
         print(f"Trying to resolve: {domain}")
         ip_address = socket.gethostbyname(domain)
         print(f"✅ Resolved {domain} to IP: {ip_address}")

custom-domain/dstack-ingress/scripts/dnsguide.py

@@ -491,12 +491,6 @@ def main() -> int:
         default=os.environ.get("DOH_RESOLVERS", os.environ.get("DOH_RESOLVER", DEFAULT_DOH)),
         help="comma-separated DoH endpoints",
     )
-    parser.add_argument(
-        "--resolve",
-        default="",
-        help="print the A records for a name and exit (used to publish the "
-             "gateway address into a delegated zone)",
-    )
     parser.add_argument("--json", action="store_true", help="also emit the records as JSON")
     parser.add_argument(
         "--include",
@@ -506,20 +500,12 @@ def main() -> int:
     )
     args = parser.parse_args()
 
-    if not args.resolve:
-        missing = [n for n, v in (("--domain", args.domain),
-                                  ("--alias-target", args.alias_target),
-                                  ("--txt-name", args.txt_name),
-                                  ("--txt-value", args.txt_value)) if not v]
-        if missing:
-            parser.error(f"{', '.join(missing)} required unless --resolve is given")
-
-    if args.resolve:
-        # Address lookup for callers that need to publish an A record rather
-        # than a CNAME. Same resolvers, same union semantics as everything else.
-        for addr in query_union(args.resolve, RR_A, args.resolver):
-            print(addr)
-        return 0
+    missing = [n for n, v in (("--domain", args.domain),
+                              ("--alias-target", args.alias_target),
+                              ("--txt-name", args.txt_name),
+                              ("--txt-value", args.txt_value)) if not v]
+    if missing:
+        parser.error(f"{', '.join(missing)} are required")
 
     if not args.caa_name:
         args.caa_name = args.domain.lstrip("*.")

custom-domain/dstack-ingress/scripts/dnsman.py

@@ -1,7 +1,6 @@
 #!/usr/bin/env python3
 
 from dns_providers import DNSProviderFactory
-from dns_providers.base import RecordType
 import argparse
 import os
 import sys
@@ -15,11 +14,10 @@ def main():
     )
     parser.add_argument(
         "action",
-        choices=["provider", "set_cname", "set_alias", "set_a", "set_txt", "unset_txt", "unset", "set_caa"],
+        choices=["set_cname", "set_alias", "set_txt", "unset_txt", "set_caa"],
         help="Action to perform",
     )
     parser.add_argument("--domain", default="", help="Domain name")
-    parser.add_argument("--type", default="", help="Record type, for unset")
     parser.add_argument("--provider", help="DNS provider (cloudflare, linode)")
     # Zone ID is now handled internally by each provider
     parser.add_argument(
@@ -32,11 +30,6 @@ def main():
 
     args = parser.parse_args()
 
-    if args.action == "provider":
-        # Which provider is in use, so callers can adapt to what it allows.
-        print(DNSProviderFactory._detect_provider_type())
-        return
-
     if not args.domain:
         print("Error: --domain is required", file=sys.stderr)
         sys.exit(1)
@@ -78,23 +71,6 @@ def main():
                 sys.exit(1)
             print(f"Successfully set TXT record for {args.domain}")
 
-        elif args.action == "set_a":
-            success = provider.set_a_record(args.domain, args.content)
-            if not success:
-                print(f"Failed to set A record for {args.domain}", file=sys.stderr)
-                sys.exit(1)
-            print(f"Successfully set A record for {args.domain}")
-
-        elif args.action == "unset":
-            if not args.type:
-                print("Error: --type is required for unset", file=sys.stderr)
-                sys.exit(1)
-            success = provider.unset_records(args.domain, RecordType[args.type.upper()])
-            if not success:
-                print(f"Failed to unset {args.type} records for {args.domain}", file=sys.stderr)
-                sys.exit(1)
-            print(f"Successfully unset {args.type} records for {args.domain}")
-
         elif args.action == "unset_txt":
             success = provider.unset_txt_record(args.domain)
             if not success: