fix(dstack-ingress): reject tls-alpn-01 wildcards at startup, not per pass

A wildcard under tls-alpn-01 can never succeed -- RFC 8737 forbids the
challenge for wildcard identifiers -- so it is a configuration error, not
a runtime failure. tlsalpn.sh did reject it, but only once the
certificate loop reached that domain, by which point the container had
generated a placeholder certificate for a name that will never get a real
one, started haproxy serving it, and settled into retrying an
unsatisfiable config every 60s to 1800s forever.

Check it alongside the other startup validation instead. A wildcard
anywhere in DOMAIN/DOMAINS now fails the container immediately, naming
the offending entry.

This is deliberately fatal for the whole container rather than skipping
the one domain. Mixed configs did already contain the damage -- the other
domains were issued normally -- but the operator was left with a
self-signed certificate served for the wildcard indefinitely and a
permanently failing loop, which reads as a TLS bug rather than the config
error it is.

The per-domain checks in tlsalpn.sh and legoman.py stay as defence in
depth. dns-01 wildcards are unaffected.

Author: kvinwang

custom-domain/dstack-ingress/README.md

@@ -325,7 +325,10 @@ Encrypt dropping expiry mail, and the container passes it for you.
 ### Limitations
 
 - **No wildcards.** RFC 8737 forbids tls-alpn-01 for wildcard identifiers, and
-  the CA will not offer the challenge. Use `dns-01` for `*.example.com`.
+  the CA will not offer the challenge. The container refuses to start rather
+  than serve a name it can never obtain a certificate for, so a wildcard
+  anywhere in `DOMAIN`/`DOMAINS` is a startup error even if the other names are
+  fine. Use `dns-01` for `*.example.com`.
 - **The gateway must be reachable on port 443.** The CA connects to port 443 of
   whatever the CNAME resolves to; the port is fixed by the protocol.
 - **CAA must permit `tls-alpn-01`.** A record left over from a `dns-01`

custom-domain/dstack-ingress/scripts/entrypoint.sh

@@ -73,6 +73,23 @@ done
 export PORT DOMAIN DOMAINS TARGET_ENDPOINT ROUTING_MAP TXT_PREFIX MAXCONN
 export TIMEOUT_CONNECT TIMEOUT_CLIENT TIMEOUT_SERVER EVIDENCE_SERVER EVIDENCE_PORT ALPN
 
+# A wildcard under tls-alpn-01 can never succeed -- RFC 8737 forbids the
+# challenge for wildcard identifiers -- so treat it as the configuration error it
+# is rather than a runtime failure. tlsalpn.sh does reject it per domain, but by
+# then the container has generated a placeholder certificate for a name that will
+# never get a real one, started serving it, and settled into retrying an
+# unsatisfiable config forever. Catching it here fails the container at start,
+# where the operator is looking.
+if [ "$CHALLENGE_TYPE" = "tls-alpn-01" ]; then
+    wildcards=$(get-all-domains.sh | grep '^\*\.' || true)
+    if [ -n "$wildcards" ]; then
+        echo "Error: tls-alpn-01 cannot issue wildcard certificates (RFC 8737)." >&2
+        echo "$wildcards" | sed 's/^/  /' >&2
+        echo "Use CHALLENGE_TYPE=dns-01 for wildcards, or list the names individually." >&2
+        exit 1
+    fi
+fi
+
 case "$CHALLENGE_TYPE" in
     dns-01)
         exec /scripts/dns01.sh "$@"