fix(ingress): fix cert path for wildcard domains

Certbot stores wildcard certs without the "*." prefix (e.g.
*.example.com → /etc/letsencrypt/live/example.com/). Add cert_dir_name
helper to strip the prefix when constructing certificate paths in nginx
config and evidence generation.

Author: kvinwang

custom-domain/dstack-ingress/scripts/entrypoint.sh

@@ -106,6 +106,9 @@ EOF
 setup_py_env
 
 setup_nginx_conf() {
+    local cert_name
+    cert_name=$(cert_dir_name "$DOMAIN")
+
     local client_max_body_size_conf=""
     if [ -n "$CLIENT_MAX_BODY_SIZE" ]; then
         client_max_body_size_conf="    client_max_body_size ${CLIENT_MAX_BODY_SIZE};"
@@ -148,8 +151,8 @@ server {
     server_name ${DOMAIN};
 
     # SSL certificate configuration
-    ssl_certificate /etc/letsencrypt/live/${DOMAIN}/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/${DOMAIN}/privkey.pem;
+    ssl_certificate /etc/letsencrypt/live/${cert_name}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/${cert_name}/privkey.pem;
 
     # Modern SSL configuration - TLS 1.2 and 1.3 only
     ssl_protocols TLSv1.2 TLSv1.3;
@@ -166,7 +169,7 @@ server {
     # Enable OCSP stapling
     ssl_stapling on;
     ssl_stapling_verify on;
-    ssl_trusted_certificate /etc/letsencrypt/live/${DOMAIN}/fullchain.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/${cert_name}/fullchain.pem;
     resolver 8.8.8.8 8.8.4.4 valid=300s;
     resolver_timeout 5s;
 

custom-domain/dstack-ingress/scripts/functions.sh

@@ -112,6 +112,14 @@ sanitize_proxy_buffers() {
     fi
 }
 
+# Get the certbot certificate directory name for a domain.
+# Certbot stores wildcard certs without the "*." prefix:
+#   *.example.com → /etc/letsencrypt/live/example.com/
+cert_dir_name() {
+    local domain="$1"
+    echo "${domain#\*.}"
+}
+
 get_letsencrypt_account_path() {
     local base_path="/etc/letsencrypt/accounts"
     local api_endpoint="acme-v02.api.letsencrypt.org"

custom-domain/dstack-ingress/scripts/generate-evidences.sh

@@ -23,7 +23,7 @@ fi
 # Copy all certificate files
 while IFS= read -r domain; do
     [[ -n "$domain" ]] || continue
-    cert_file="/etc/letsencrypt/live/${domain}/fullchain.pem"
+    cert_file="/etc/letsencrypt/live/$(cert_dir_name "$domain")/fullchain.pem"
     if [ -f "$cert_file" ]; then
         cp "$cert_file" "cert-${domain}.pem"
     else