feat: support wildcard custom domains in gateway TXT resolution

Add fallback to `_dstack-app-address-wildcard.{parent}` TXT record
when exact `_dstack-app-address.{sni}` lookup fails. This allows a
single TXT record to route all subdomains of a custom domain to the
same app, while still allowing per-subdomain overrides via exact records.

Author: kvinwang

gateway/src/proxy/tls_passthough.rs

@@ -34,43 +34,50 @@ impl AppAddress {
     }
 }
 
-/// resolve app address by sni
+/// Resolve app address by sni, with wildcard domain fallback.
+///
+/// Lookup order:
+/// 1. `{prefix}.{sni}` — exact match (e.g. `_dstack-app-address.foo.myapp.com`)
+/// 2. (compat) `_tapp-address.{sni}` — legacy exact match
+/// 3. `{prefix}-wildcard.{parent}` — wildcard match (e.g. `_dstack-app-address-wildcard.myapp.com`)
 async fn resolve_app_address(prefix: &str, sni: &str, compat: bool) -> Result<AppAddress> {
-    let txt_domain = format!("{prefix}.{sni}");
     let resolver = hickory_resolver::AsyncResolver::tokio_from_system_conf()
         .context("failed to create dns resolver")?;
 
+    // 1. Try exact match
+    let mut domains = vec![format!("{prefix}.{sni}")];
     if compat && prefix != "_tapp-address" {
-        let txt_domain_legacy = format!("_tapp-address.{sni}");
-        let (lookup, lookup_legacy) = tokio::join!(
-            resolver.txt_lookup(txt_domain),
-            resolver.txt_lookup(txt_domain_legacy),
-        );
-        for lookup in [lookup, lookup_legacy] {
-            let Ok(lookup) = lookup else {
-                continue;
-            };
-            let Some(txt_record) = lookup.iter().next() else {
-                continue;
-            };
-            let Some(data) = txt_record.txt_data().first() else {
+        domains.push(format!("_tapp-address.{sni}"));
+    }
+
+    // 2. Try wildcard fallback on parent domain
+    if let Some((_, parent)) = sni.split_once('.') {
+        domains.push(format!("{prefix}-wildcard.{parent}"));
+    }
+
+    for domain in &domains {
+        let Ok(lookup) = resolver.txt_lookup(domain.as_str()).await else {
+            continue;
+        };
+        let Some(txt_record) = lookup.iter().next() else {
+            continue;
+        };
+        let Some(data) = txt_record.txt_data().first() else {
+            continue;
+        };
+        match AppAddress::parse(data) {
+            Ok(addr) => {
+                debug!("resolved app address via TXT {domain}");
+                return Ok(addr);
+            }
+            Err(e) => {
+                warn!("failed to parse app address from TXT {domain}: {e}");
                 continue;
-            };
-            return AppAddress::parse(data).context("failed to parse app address");
+            }
         }
-        anyhow::bail!("failed to resolve legacy app address");
-    } else {
-        let lookup = resolver
-            .txt_lookup(txt_domain)
-            .await
-            .context("failed to lookup app address")?;
-        let txt_record = lookup.iter().next().context("no txt record found")?;
-        let data = txt_record
-            .txt_data()
-            .first()
-            .context("no data in txt record")?;
-        AppAddress::parse(data).context("failed to parse app address")
     }
+
+    bail!("failed to resolve app address for {sni} (tried: {})", domains.join(", "));
 }
 
 pub(crate) async fn proxy_with_sni(