feat(dstack-ingress): delegate a wildcard's CAA too, via a fourth alias

I had written wildcards off: RFC 8659 evaluates *.example.com at
example.com, and I took "that is the operator's own name" to mean it
could not be delegated. It can -- the operator aliases the base as well,
and the CA follows that CNAME like any other.

Verified against the staging CA. With

    *.wb.kvin.wang  CNAME  wb.kvin.wang.bz.kvin.wang
    wb.kvin.wang    CNAME  wb.kvin.wang.bz.kvin.wang
    wb.kvin.wang.bz.kvin.wang  CAA  0 issuewild "example.invalid"

issuance was refused with `While processing CAA for *.wb.kvin.wang: CAA
record for wb.kvin.wang prevents issuance`, which is the CA following the
base's alias into the delegated zone and honouring what it found.

So dnsguide asks for a fourth CNAME on wildcards, and the container
publishes the CAA with the issuewild tag rather than skipping it.

The limit is narrower than "wildcards": it is zone apexes. *.example.com
under the example.com zone still cannot have its base aliased, because an
apex carries SOA and NS and a CNAME excludes them. *.app.example.com can.
Where it cannot, the CAA check reports the record missing rather than the
container pretending to have set it.

Author: kvinwang

custom-domain/dstack-ingress/README.md

@@ -251,9 +251,21 @@ A wildcard and its base name share a delegated target: both `*.example.com` and
 is fine, since it publishes the same values twice. Two deployments pointing at
 different gateways are not — give them separate delegation zones.
 
-**Wildcards keep an operator-managed CAA.** RFC 8659 evaluates `*.example.com`
-at `example.com`, which is your own name and cannot be aliased away, so for a
-wildcard the container prints the CAA and verifies it rather than publishing it.
+**A wildcard needs a fourth CNAME.** RFC 8659 evaluates `*.app.example.com` at
+`app.example.com`, so the base gets its own alias and the container publishes an
+`issuewild` CAA behind it:
+
+```
+*.app.example.com                            CNAME  app.example.com.deleg.example.net
+app.example.com                              CNAME  app.example.com.deleg.example.net
+_dstack-app-address-wildcard.app.example.com CNAME  _dstack-app-address-wildcard.app.example.com.deleg.example.net
+_acme-challenge.app.example.com              CNAME  _acme-challenge.app.example.com.deleg.example.net
+```
+
+This only works where the base is **not a zone apex**. `*.example.com` under the
+`example.com` zone cannot have `example.com` aliased — an apex carries SOA and NS
+records, which a CNAME excludes — so there the CAA stays operator-managed and the
+check reports it missing until you create it.
 
 > **Security note.** The `accounturi` CAA restricts issuance to this enclave's
 > ACME account and is the control that prevents forged certificates. In

custom-domain/dstack-ingress/scripts/dns01.sh

@@ -175,21 +175,20 @@ delegation_publish() {
     dnsman.py set_txt --domain "$txt_name" --content "$(txt_record_value)" || return 1
 }
 
-# The accounturi CAA goes on the delegated name, beside the address record.
+# The accounturi CAA goes on the delegated name, beside the gateway pointer.
 #
-# Not for a wildcard: RFC 8659 evaluates `*.example.com` at `example.com`, which
-# is the operator's own name and cannot be aliased away. Wildcards keep the
-# operator-managed CAA.
+# A wildcard is evaluated at its base (RFC 8659), so it needs the `issuewild`
+# tag and it needs the operator to have aliased the base as well -- dnsguide
+# asks for that fourth CNAME. Where the base is a zone apex the operator cannot
+# alias it (an apex carries SOA and NS, which a CNAME excludes), and the check
+# below reports the CAA as missing rather than pretending to have set it.
 delegation_publish_caa() {
     local domain="$1" account_file account_uri
-    if [[ "$domain" == \*.* ]]; then
-        return 2
-    fi
     account_file=$(get_letsencrypt_account_file) || return 1
     account_uri=$(jq -j '.uri' "$account_file")
     dnsman.py set_caa \
         --domain "$(delegated_name "$domain")" \
-        --caa-tag issue \
+        --caa-tag "$(caa_tag_for "$domain")" \
         --caa-value "letsencrypt.org;validationmethods=dns-01;accounturi=$account_uri"
 }
 
@@ -252,17 +251,11 @@ set_caa_record() {
     # thing stopping anyone else who can satisfy the delegated challenge, so it
     # is not optional here.
     if [ -n "${DELEGATION_ZONE:-}" ]; then
-        delegation_publish_caa "$domain"
-        case $? in
-            0) return ;;
-            2) # Wildcard: RFC 8659 evaluates *.example.com at example.com,
-               # which is the operator's own name and cannot be aliased away,
-               # so ask for it instead of publishing it.
-               delegation_verify_caa "$domain" || exit 1
-               return ;;
-            *) echo "Error: could not publish the CAA record for $domain" >&2
-               exit 1 ;;
-        esac
+        if ! delegation_publish_caa "$domain"; then
+            echo "Error: could not publish the CAA record for $domain" >&2
+            exit 1
+        fi
+        return
     fi
 
     if [ "$SET_CAA" != "true" ]; then

custom-domain/dstack-ingress/scripts/dnsguide.py

@@ -413,11 +413,23 @@ def build_records(args: argparse.Namespace) -> List[Record]:
         # rather than as "does not resolve".
         base = args.domain[2:] if args.domain.startswith("*.") else args.domain
         alias = args.challenge_alias
-        for name, note in (
+        wanted = [
             (args.domain, "routes traffic for this hostname into the delegated zone"),
             (args.txt_name, "lets the container publish the gateway routing target"),
             (f"_acme-challenge.{base}", "delegates the ACME challenge"),
-        ):
+        ]
+        if args.domain.startswith("*."):
+            # RFC 8659 evaluates CAA for *.example.com at example.com, not at the
+            # wildcard, so the base needs its own alias for the CAA to be
+            # delegated too. Verified: with this in place the CA followed it and
+            # honoured an issuewild record in the delegated zone.
+            #
+            # Only possible when the base is not a zone apex -- an apex carries
+            # SOA and NS, and a CNAME excludes them. `*.example.com` under the
+            # `example.com` zone therefore keeps an operator-managed CAA;
+            # `*.app.example.com` does not.
+            wanted.insert(1, (base, "delegates CAA, which a wildcard is evaluated at"))
+        for name, note in wanted:
             records.append(
                 Record(
                     type="CNAME",

custom-domain/dstack-ingress/scripts/tests/test_dnsguide.py

@@ -146,6 +146,29 @@ def test_absent_without_a_delegation_zone(self):
         self.assertEqual(dnsguide.build_records(self._args("svc.example.com", "")), [])
 
 
+class TestWildcardDelegation(unittest.TestCase):
+    """A wildcard is evaluated at its base, so the base needs its own alias."""
+
+    def _records(self, domain, txt):
+        import argparse
+        return dnsguide.build_records(argparse.Namespace(
+            domain=domain, alias_target="gw", txt_name=txt, txt_value="x",
+            caa_name="", caa_tag="issue", caa_value="", account_uri="",
+            challenge="dns-01", challenge_alias="deleg.net", include="delegated"))
+
+    def test_wildcard_aliases_its_base_as_well(self):
+        names = [r.name for r in self._records(
+            "*.app.example.com", "_dstack-app-address-wildcard.app.example.com")]
+        self.assertIn("app.example.com", names)
+        self.assertEqual(len(names), 4)
+
+    def test_plain_domain_does_not(self):
+        names = [r.name for r in self._records(
+            "svc.example.com", "_dstack-app-address.svc.example.com")]
+        self.assertNotIn("example.com", names)
+        self.assertEqual(len(names), 3)
+
+
 class TestExactCnameCheck(unittest.TestCase):
     """check_alias falls back to comparing addresses; a delegation target has none."""