refactor(dstack-ingress): drop the old delegation variable, pick the gateway

record type per provider

DELEGATION_ZONE is now the only name; ACME_CHALLENGE_ALIAS is gone rather
than deprecated. The feature is days old and the published image does not
carry it, so there is nobody to keep compatible with, and one name is
worth more than two.

The gateway pointer's record type now follows the provider instead of
defaulting to CNAME everywhere. A CNAME is better -- DNS follows a gateway
that moves -- but the same name has to carry the CAA too, which RFC 1034
forbids. Cloudflare allows the pair and Let's Encrypt honours the CAA
there; providers that enforce the standard reject it, and would have
failed at the CAA write with the old default.

Only Cloudflare has been tested, so only Cloudflare gets `cname` and
everything else gets `a`, which is legal everywhere. Operators who know
their provider allows the pair can set DELEGATION_GATEWAY_RECORD=cname.
dnsman.py grew a `provider` action so the shell can ask.

Verified that wildcards work end to end, which was not obvious: a
wildcard CNAME copies its target verbatim rather than expanding it
(RFC 4592), so every subdomain lands on one concrete delegated name.
`*.wc.kvin.wang` issued against the staging CA, and a.wc / xyz.wc both
resolve through that name to the gateway.

Author: kvinwang

custom-domain/dstack-ingress/README.md

@@ -193,7 +193,7 @@ environment:
 | `ALPN` | | TLS ALPN protocols (e.g. `h2,http/1.1`). Only set if backends support h2c |
 | `DELEGATION_ZONE` | | Zone this container writes into, so the DNS token needs no access to the served domain's own zone (see below). `ACME_CHALLENGE_ALIAS` is the original name and still works |
 | `ACME_CHALLENGE_PROPAGATION_SECONDS` | `120` | Wait after writing the delegated challenge TXT before validation. Must outlast the record TTL (60s), or a resolver still serving the previous attempt's value fails validation. Keep well under ~250s — certbot is killed after a 300s per-run timeout |
-| `DELEGATION_GATEWAY_RECORD` | `cname` | How the delegated name points at the gateway: `cname` (follows a gateway that moves) or `a` (for providers that refuse a CAA beside a CNAME) |
+| `DELEGATION_GATEWAY_RECORD` | per provider | How the delegated name points at the gateway: `cname` (Cloudflare default; follows a gateway that moves) or `a` (default elsewhere, for providers that refuse a CAA beside a CNAME) |
 | `ALLOW_MISSING_CAA` | `false` | In delegation mode, treat an unconfirmed `accounturi` CAA as a warning instead of a blocker. Default fails closed (see below) |
 
 For DNS provider credentials, see [DNS_PROVIDERS.md](DNS_PROVIDERS.md).
@@ -227,18 +227,24 @@ _dstack-app-address.svc.example.com.deleg.example.net  TXT    "<app-id>:<port>"
 _acme-challenge.svc.example.com.deleg.example.net      TXT    <challenge>   (transient)
 ```
 
-A CNAME and a CAA on the same name is a Cloudflare allowance, not a standard
-one — RFC 1034 says a CNAME excludes every other type at its name. It works
-because the resolver stops at the first name in the chain that carries a CAA,
-and Let's Encrypt honours what it finds there: with a CAA that forbids it,
-the staging CA refuses with `While processing CAA for svc.example.com: CAA
-record for svc.example.com prevents issuance`.
-
-Providers that enforce the standard will reject the CAA beside the CNAME. Set
-`DELEGATION_GATEWAY_RECORD=a` there: the container resolves `GATEWAY_DOMAIN`
-itself and publishes an address record, which can carry the CAA. The cost is
-that a gateway which moves is then only picked up on the next pass, where a
-CNAME follows it immediately.
+The gateway pointer and the CAA share a name, which RFC 1034 does not allow —
+a CNAME excludes every other type at its name. **Cloudflare allows the pair
+anyway**, and Let's Encrypt honours the CAA it finds there: with a CAA that
+forbids it, the staging CA refuses with `While processing CAA for
+svc.example.com: CAA record for svc.example.com prevents issuance`.
+
+Providers that enforce the standard will reject the CAA beside the CNAME, so
+they get an address record instead — `A` and `CAA` coexist legally. The default
+follows the provider:
+
+| Provider | Gateway pointer | Gateway that moves |
+|---|---|---|
+| `cloudflare` | `CNAME` to `GATEWAY_DOMAIN` | followed by DNS, immediately |
+| everything else | `A`, re-resolved each pass | picked up within `RENEW_INTERVAL` |
+
+`DELEGATION_GATEWAY_RECORD=cname\|a` overrides it. Only Cloudflare has been
+tested; if another provider accepts a CAA beside a CNAME, setting `cname` there
+gets the better behaviour.
 
 A wildcard and its base name share a delegated target: both `*.example.com` and
 `example.com` map to `example.com.<delegation-zone>`. One deployment serving both

custom-domain/dstack-ingress/scripts/acme-dns-alias-hook.sh

@@ -18,10 +18,7 @@ set -euo pipefail
 
 action="${1:-}"
 
-# DELEGATION_ZONE is the current name; ACME_CHALLENGE_ALIAS is the original one
-# and still works. certbot runs this as a fresh process, so resolve both here
-# rather than relying on the caller.
-zone="${DELEGATION_ZONE:-${ACME_CHALLENGE_ALIAS:-}}"
+zone="${DELEGATION_ZONE:-}"
 if [ -z "$zone" ]; then
     echo "acme-dns-alias-hook: DELEGATION_ZONE is not set" >&2
     exit 1

custom-domain/dstack-ingress/scripts/certman.py

@@ -283,7 +283,7 @@ def _build_certbot_command(self, action: str, domain: str, email: str) -> List[s
         # DNS-01 challenge in a delegated zone via a manual hook instead of the
         # provider's certbot plugin, so our DNS token never needs access to the
         # served domain's own zone. See scripts/acme-dns-alias-hook.sh.
-        if os.environ.get("DELEGATION_ZONE", "").strip() or os.environ.get("ACME_CHALLENGE_ALIAS", "").strip():
+        if os.environ.get("DELEGATION_ZONE", "").strip():
             hook = "/scripts/acme-dns-alias-hook.sh"
             base_cmd = certbot_cmd + [action, "--non-interactive", "-v"]
             if action == "certonly":

custom-domain/dstack-ingress/scripts/dns01.sh

@@ -11,11 +11,8 @@ source /scripts/functions.sh
 source /scripts/haproxy-lib.sh
 source /scripts/evidence-lib.sh
 
-# The zone this container writes into. ACME_CHALLENGE_ALIAS was the original
-# name, from when the challenge was the only thing delegated; it now decides the
-# target of every record, so DELEGATION_ZONE is what it is called. The old name
-# still works.
-DELEGATION_ZONE=${DELEGATION_ZONE:-${DELEGATION_ZONE:-}}
+# The zone this container writes into, and the switch that turns delegation on.
+DELEGATION_ZONE=${DELEGATION_ZONE:-}
 export DELEGATION_ZONE
 
 # ACME_EMAIL / ACME_STAGING are normalised by entrypoint.sh and exported. The
@@ -119,13 +116,29 @@ set_txt_record() {
 # never needs touching again -- not when the app id changes with the compose,
 # not when the ACME account is recreated, not when the gateway moves.
 #
-# The gateway pointer stays a CNAME, so a gateway that moves is followed
-# automatically. That the same name can also carry the CAA is a Cloudflare
-# allowance rather than a standard one -- RFC 1034 says a CNAME excludes every
-# other type at its name -- but Let's Encrypt honours it: the resolver stops at
-# the first name in the chain that has a CAA, and the staging CA refuses to
-# issue when that record forbids it. Providers that enforce the standard will
-# reject the CAA here; see DELEGATION_GATEWAY_RECORD.
+# How the delegated name points at the gateway.
+#
+# A CNAME is better -- a gateway that moves is followed automatically -- but the
+# same name also has to carry the CAA, and RFC 1034 says a CNAME excludes every
+# other type at its name. Cloudflare allows the pair anyway, and Let's Encrypt
+# honours the CAA it finds there (verified against the staging CA). Providers
+# that enforce the standard reject it, so they get an address record instead:
+# A and CAA coexist legally, at the cost of re-resolving GATEWAY_DOMAIN once a
+# pass rather than letting DNS follow it.
+#
+# Default per provider, since only Cloudflare is known to allow the pair.
+# DELEGATION_GATEWAY_RECORD overrides it either way.
+delegation_gateway_record() {
+    if [ -n "${DELEGATION_GATEWAY_RECORD:-}" ]; then
+        echo "$DELEGATION_GATEWAY_RECORD"
+        return
+    fi
+    case "$(dnsman.py provider 2>/dev/null)" in
+        cloudflare) echo cname ;;
+        *) echo a ;;
+    esac
+}
+
 delegated_name() {
     local domain="${1#\*.}"
     echo "${domain}.${DELEGATION_ZONE}"
@@ -135,7 +148,7 @@ delegation_publish() {
     local domain="$1" target txt_name
     target=$(delegated_name "$domain")
 
-    case "${DELEGATION_GATEWAY_RECORD:-cname}" in
+    case "$(delegation_gateway_record)" in
         cname)
             dnsman.py set_alias --domain "$target" --content "$GATEWAY_DOMAIN" || return 1
             ;;

custom-domain/dstack-ingress/scripts/dnsguide.py

@@ -470,7 +470,7 @@ def main() -> int:
     parser.add_argument("--challenge", default="tls-alpn-01")
     parser.add_argument(
         "--challenge-alias",
-        default=os.environ.get("DELEGATION_ZONE", os.environ.get("ACME_CHALLENGE_ALIAS", "")),
+        default=os.environ.get("DELEGATION_ZONE", ""),
         help="delegation zone for the _acme-challenge CNAME (dns-01 delegation)",
     )
     parser.add_argument(

custom-domain/dstack-ingress/scripts/dnsman.py

@@ -14,10 +14,10 @@ def main():
     )
     parser.add_argument(
         "action",
-        choices=["set_cname", "set_alias", "set_a", "set_txt", "unset_txt", "set_caa"],
+        choices=["provider", "set_cname", "set_alias", "set_a", "set_txt", "unset_txt", "set_caa"],
         help="Action to perform",
     )
-    parser.add_argument("--domain", required=True, help="Domain name")
+    parser.add_argument("--domain", default="", help="Domain name")
     parser.add_argument("--provider", help="DNS provider (cloudflare, linode)")
     # Zone ID is now handled internally by each provider
     parser.add_argument(
@@ -30,6 +30,15 @@ def main():
 
     args = parser.parse_args()
 
+    if args.action == "provider":
+        # Which provider is in use, so callers can adapt to what it allows.
+        print(DNSProviderFactory._detect_provider_type())
+        return
+
+    if not args.domain:
+        print("Error: --domain is required", file=sys.stderr)
+        sys.exit(1)
+
     try:
         # Create DNS provider instance
         provider = DNSProviderFactory.create_provider(args.provider)