fix(dstack-ingress): reload haproxy only when a certificate was actually renewed

certman.py distinguishes 'renewed' (0) from 'nothing to renew' (2), but
renew-certificate.sh collapsed both to exit 0, so the renewal daemon
rebuilt the PEMs and reloaded haproxy on every 12-hour check cycle even
though certificates renew roughly every 60 days. Propagate exit 2 and
make the daemon treat only a real renewal as reload-worthy.

entrypoint.sh runs under set -e and calls renew-certificate.sh
unguarded during bootstrap, where the certificate has just been issued
and the second call now exits 2 — tolerate that explicitly so
bootstrap does not abort.

Author: pacoyang

custom-domain/dstack-ingress/scripts/entrypoint.sh

@@ -356,9 +356,11 @@ process_domain() {
 
     set_alias_record "$domain"
     set_txt_record "$domain"
-    renew-certificate.sh "$domain" || echo "First certificate renewal failed for $domain, will retry after set CAA record"
+    # renew-certificate.sh exits 0 on renewal, 2 when nothing needed renewal
+    # (not a failure — this script runs under `set -e`), 1 on real failure.
+    renew-certificate.sh "$domain" || [ $? -eq 2 ] || echo "First certificate renewal failed for $domain, will retry after set CAA record"
     set_caa_record "$domain"
-    renew-certificate.sh "$domain"
+    renew-certificate.sh "$domain" || [ $? -eq 2 ]
 }
 
 bootstrap() {

custom-domain/dstack-ingress/scripts/renew-certificate.sh

@@ -8,11 +8,17 @@ SCRIPT_DIR="$(dirname "$(readlink -f "$0")")"
 python3 "$SCRIPT_DIR/certman.py" auto --domain "$DOMAIN" --email "$CERTBOT_EMAIL"
 CERT_STATUS=$?
 
-if [ $CERT_STATUS -eq 1 ]; then
-    echo "Certificate management failed" >&2
-    exit 1
-elif [ $CERT_STATUS -eq 2 ]; then
+if [ $CERT_STATUS -eq 2 ]; then
     echo "No certificates need renewal, skipping evidence generation"
+    # Propagate "nothing renewed" so the renewal daemon does not rebuild
+    # PEMs and reload haproxy on every check cycle.
+    exit 2
+elif [ $CERT_STATUS -ne 0 ]; then
+    # 1 is certman's failure exit; anything else (127 missing interpreter,
+    # 130 signal, ...) is just as much a failure — never let it fall through
+    # to "renewed", which would trigger a spurious PEM rebuild + reload.
+    echo "Certificate management failed (status $CERT_STATUS)" >&2
+    exit 1
 fi
 
 exit 0

custom-domain/dstack-ingress/scripts/renewal-daemon.sh

@@ -10,10 +10,16 @@ while true; do
         while IFS= read -r domain; do
             [[ -n "$domain" ]] || continue
             echo "[$(date)] Checking renewal for domain: $domain"
-            if renew-certificate.sh "$domain"; then
+            renew-certificate.sh "$domain"
+            status=$?
+            # 0 = a certificate was actually renewed; 2 = nothing to renew.
+            # Only a real renewal warrants a PEM rebuild + haproxy reload —
+            # reloading on every check cycle replaced the worker (and its
+            # accumulated state) twice a day for no reason.
+            if [ $status -eq 0 ]; then
                 renewal_occurred=true
-            else
-                echo "Certificate renewal check failed for $domain with status $?"
+            elif [ $status -ne 2 ]; then
+                echo "Certificate renewal check failed for $domain with status $status"
             fi
         done <<<"$all_domains"