fix(dstack-ingress): stop dns-01 running the first pass twice

dns-01 issues before it serves, so run_pass is called explicitly at
startup and cert_loop then ran it again immediately. For a single domain
that is four certbot invocations and two rounds of DNS writes on every
container start, all to reach a state the first pass had already reached.

The duplicate is inherited from upstream, where bootstrap and the renewal
daemon both ran at startup with no initial sleep; the refactor kept it
faithfully. tls-alpn-01 never had it because there is no bootstrap pass
to duplicate.

Also deduplicate CAA records after parsing rather than before. Resolvers
disagree on the wire format -- Cloudflare returns RFC 3597 generic hex,
Google the presentation form -- so one record arrives as two distinct
strings and its rejection reason was printed twice.

Author: kvinwang

custom-domain/dstack-ingress/scripts/dns01.sh

@@ -234,20 +234,26 @@ run_pass() {
     [ "$failed" -eq 0 ]
 }
 
+# $1: seconds to wait before the first pass. dns-01 issues before it serves, so
+# the caller has already run a pass by the time we get here; without this the
+# loop would immediately repeat it -- two full passes, and for a single domain
+# four certbot invocations plus a duplicate round of DNS writes, on every start.
 cert_loop() {
-    local attempt=0 delay
+    local attempt=0 delay="${1:-0}"
     while true; do
+        if [ "$delay" -gt 0 ]; then
+            echo "[$(date)] Next certificate check in ${delay}s"
+            sleep "$delay"
+        fi
         if run_pass; then
             attempt=0
             delay=${RENEW_INTERVAL:-43200}
         else
             attempt=$((attempt + 1))
             delay=$((60 * attempt))
             [ "$delay" -gt 1800 ] && delay=1800
-            echo "[$(date)] Pass failed (attempt ${attempt}); retrying in ${delay}s"
+            echo "[$(date)] Pass failed (attempt ${attempt}); retrying" >&2
         fi
-        echo "[$(date)] Next certificate check in ${delay}s"
-        sleep "$delay"
     done
 }
 
@@ -265,6 +271,6 @@ haproxy_emit_tls_frontend ":${PORT}"
 haproxy_emit_backends
 
 evidence_start_server
-cert_loop &
+cert_loop "${RENEW_INTERVAL:-43200}" &
 
 exec "$@"

custom-domain/dstack-ingress/scripts/dnsguide.py

@@ -265,7 +265,15 @@ def check_caa(
         candidate = ".".join(labels[i:])
         # Union: one resolver seeing a restriction is enough to honour it.
         rdatas = query_union(candidate, RR_CAA, resolvers)
-        parsed = [p for p in (_parse_caa(r) for r in rdatas) if p is not None]
+        # Deduplicate after parsing, not before: resolvers disagree on the wire
+        # format (one returns presentation form, another RFC 3597 generic hex),
+        # so the same record arrives as two distinct strings and would otherwise
+        # be reported, and counted, twice.
+        parsed = []
+        for rdata in rdatas:
+            record = _parse_caa(rdata)
+            if record is not None and record not in parsed:
+                parsed.append(record)
         relevant = [p for p in parsed if p[1] == want_tag]
         if not parsed:
             continue  # keep climbing; this level has no CAA record set

custom-domain/dstack-ingress/scripts/tests/test_dnsguide.py

@@ -84,6 +84,41 @@ def test_account_unknown_skips_the_comparison(self):
         self.assertTrue(ok)
 
 
+class TestCaaCheckDeduplication(unittest.TestCase):
+    """One record seen twice, in two wire formats, must be reported once.
+
+    Resolvers disagree on CAA presentation: Cloudflare hands back RFC 3597
+    generic hex, Google the human-readable form. The union is taken over raw
+    rdata, so the same record arrives as two different strings.
+    """
+
+    PRESENTATION = '0 issue "letsencrypt.org;validationmethods=dns-01"'
+    # The same record, generic-encoded: flags=0, tag len 5, "issue", value.
+    GENERIC = (
+        r"\# 44 00 05 69 73 73 75 65 6c 65 74 73 65 6e 63 72 79 70 74 2e 6f 72 67 "
+        r"3b 76 61 6c 69 64 61 74 69 6f 6e 6d 65 74 68 6f 64 73 3d 64 6e 73 2d 30 31"
+    )
+
+    def setUp(self):
+        self._saved = dnsguide.query_union
+        dnsguide.query_union = lambda name, rr, resolvers: (
+            [self.GENERIC, self.PRESENTATION] if name == "app.example.com" else []
+        )
+        self.addCleanup(lambda: setattr(dnsguide, "query_union", self._saved))
+
+    def test_both_encodings_parse_to_the_same_record(self):
+        self.assertEqual(
+            dnsguide._parse_caa(self.GENERIC), dnsguide._parse_caa(self.PRESENTATION)
+        )
+
+    def test_reason_is_not_repeated(self):
+        ok, reason = dnsguide.check_caa(
+            "app.example.com", "issue", "tls-alpn-01", "", "r1,r2"
+        )
+        self.assertFalse(ok)
+        self.assertEqual(reason.count("excludes tls-alpn-01"), 1, reason)
+
+
 class TestTxtNormalisation(unittest.TestCase):
     def test_strips_quotes(self):
         self.assertEqual(dnsguide._unquote_txt('"abc:443"'), "abc:443")