feat: add dstack-ingress for custom domain TLS (CPL-152) (#181)

* feat: add dstack-ingress for custom domain TLS (CPL-152)

Add dstack-ingress service to docker-compose.phala.yml for attestation-
bound TLS termination inside the TEE. On main branch, deploys with
DOMAIN=api.chipotle.litprotocol.com using Let's Encrypt DNS-01 via
Route 53. On next branch, dstack-ingress is removed from the deploy
compose file (no custom domain).

- docker-compose.phala.yml: add dstack-ingress service behind
  "custom-domain" profile with Route 53 DNS provider config
- deploy-phala.yml: add domain output, substitute TLS secrets in
  deploy step, conditionally strip profiles or remove service block

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: use test.chipotle.litprotocol.com for next branch

Reserve api.chipotle.litprotocol.com for main branch deployments.
The next branch gets its own custom domain at test.chipotle.litprotocol.com.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: rename Route 53 secret refs to AWS_*_CERTBOT

The GitHub secrets for the certbot Route 53 IAM credentials are named
AWS_ACCESS_KEY_ID_CERTBOT and AWS_SECRET_ACCESS_KEY_CERTBOT.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: remove compose profiles, strip dstack-ingress when no domain

Phala deploy doesn't support compose profiles, so dstack-ingress is now
unconditionally defined. The deploy workflow strips the entire service
block when DOMAIN is empty.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: rename secrets to CERTBOT_AWS_ACCESS_KEY_ID prefix convention

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: rename AWS credential placeholders to CERTBOT_ prefix

Consistent naming end-to-end: compose file placeholders, workflow sed
patterns, and GitHub secret references all use CERTBOT_AWS_ACCESS_KEY_ID
and CERTBOT_AWS_SECRET_ACCESS_KEY.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* docs: note dstack-ingress expected env var names with Phala docs link

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: rename DOMAIN placeholder to CERTBOT_DOMAIN for consistency

All dstack-ingress secrets now use CERTBOT_ prefix in the compose file
(CERTBOT_DOMAIN, CERTBOT_AWS_ACCESS_KEY_ID, CERTBOT_AWS_SECRET_ACCESS_KEY).
The deploy workflow maps them to the values dstack-ingress expects internally.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: replace dead Phala docs link with working blog post URL

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: link to dstack-ingress DNS_PROVIDERS.md for Route 53 docs

The previous link pointed to a Cloudflare-focused blog post. The actual
Route 53 env var documentation lives in the Dstack-TEE examples repo.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* docs: show optional AWS_ROLE_ARN/AWS_REGION for Route 53 role assumption

Commented out since the IAM user has direct Route 53 permissions.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add missing GATEWAY_DOMAIN for dstack-ingress

Required common variable per dstack-ingress docs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: restore underscore prefix in GATEWAY_DOMAIN

GATEWAY_DOMAIN should be _.dstack-base-prod5.phala.network per dstack-ingress docs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: CERTBOT_AWS_ACCESS_KEY_ID is a var, not a secret

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: remove optional domain logic — custom domain is mandatory

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: hardcode CERTBOT_EMAIL to admin@litprotocol.com

Not sensitive — it's public in the ACME registration anyway.
Remove the secret reference and sed substitution.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: derive base_url and api_root_url from domain

Set DOMAIN as a shell variable per branch, then derive all URL outputs
from it — removes redundant hardcoded URLs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Garandor

.github/workflows/deploy-phala.yml

@@ -49,6 +49,7 @@ jobs:
       instance_type: ${{ steps.set.outputs.instance_type }}
       gcp_project_id: ${{ steps.set.outputs.gcp_project_id }}
       node_config: ${{ steps.set.outputs.node_config }}
+      domain: ${{ steps.set.outputs.domain }}
     steps:
       - name: Set deployment target
         id: set
@@ -58,19 +59,20 @@ jobs:
             echo "instance_type=tdx.large" >> "$GITHUB_OUTPUT"
             echo "gcp_project_id=chipotle-dev" >> "$GITHUB_OUTPUT"
             echo "node_config=NodeConfig.main.toml" >> "$GITHUB_OUTPUT"
-            BASE_URL="https://f8fce543471dc9f5f5643aa217422398c36e5edc-8000.dstack-base-prod5.phala.network"
+            DOMAIN="api.chipotle.litprotocol.com"
           elif [ "${{ github.ref }}" = "refs/heads/next" ]; then
             echo "phala_app_name=chipotle-next" >> "$GITHUB_OUTPUT"
             echo "instance_type=tdx.small" >> "$GITHUB_OUTPUT"
             echo "gcp_project_id=chipotle-next" >> "$GITHUB_OUTPUT"
             echo "node_config=NodeConfig.next.toml" >> "$GITHUB_OUTPUT"
-            BASE_URL="https://969a8c14c9e13420705b19c7246aeed27897e7ea-8000.dstack-base-prod5.phala.network"
+            DOMAIN="test.chipotle.litprotocol.com"
           else
             echo "Unsupported branch for deployment"
             exit 1
           fi
-          echo "base_url=$BASE_URL" >> "$GITHUB_OUTPUT"
-          echo "api_root_url=${BASE_URL}/core/v1" >> "$GITHUB_OUTPUT"
+          echo "domain=${DOMAIN}" >> "$GITHUB_OUTPUT"
+          echo "base_url=https://${DOMAIN}" >> "$GITHUB_OUTPUT"
+          echo "api_root_url=https://${DOMAIN}/core/v1" >> "$GITHUB_OUTPUT"
 
   build:
     needs: [determine-target]
@@ -145,11 +147,15 @@ jobs:
           DIGEST_LIT_ACTIONS=$(cat digest-lit-actions.txt | tr -d '\n' | sed 's/}[}]*$//')
           DIGEST_LIT_API_SERVER=$(cat digest-lit-api-server.txt | tr -d '\n' | sed 's/}[}]*$//')
           DIGEST_OTEL_COLLECTOR=$(cat digest-otel-collector.txt | tr -d '\n' | sed 's/}[}]*$//')
+          DOMAIN="${{ needs.determine-target.outputs.domain }}"
           sed \
             -e "s|\${DOCKER_IMAGE_LIT_ACTIONS}|${{ vars.DOCKER_IMAGE }}-lit-actions@${DIGEST_LIT_ACTIONS}|g" \
             -e "s|\${DOCKER_IMAGE_LIT_API_SERVER}|${{ vars.DOCKER_IMAGE }}-lit-api-server@${DIGEST_LIT_API_SERVER}|g" \
             -e "s|\${DOCKER_IMAGE_OTEL_COLLECTOR}|${{ vars.DOCKER_IMAGE }}-otel-collector@${DIGEST_OTEL_COLLECTOR}|g" \
             -e "s|\${GCP_PROJECT_ID}|${{ needs.determine-target.outputs.gcp_project_id }}|g" \
+            -e "s|\${CERTBOT_DOMAIN}|${DOMAIN}|g" \
+            -e "s|\${CERTBOT_AWS_ACCESS_KEY_ID}|${{ vars.CERTBOT_AWS_ACCESS_KEY_ID }}|g" \
+            -e "s|\${CERTBOT_AWS_SECRET_ACCESS_KEY}|${{ secrets.CERTBOT_AWS_SECRET_ACCESS_KEY }}|g" \
             docker-compose.phala.yml > docker-compose.deploy.yml
           cat docker-compose.deploy.yml
 

docker-compose.phala.yml

@@ -13,6 +13,9 @@
 # Required secrets (set as encrypted Phala CVM environment variables):
 #   GCP_SERVICE_ACCOUNT_JSON  - GCP service account key (raw JSON or base64-encoded)
 #   GCP_PROJECT_ID            - GCP project ID (e.g. "my-gcp-project")
+#   CERTBOT_DOMAIN            - Custom domain for TLS (e.g. "api.chipotle.litprotocol.com")
+#   CERTBOT_AWS_ACCESS_KEY_ID     - Route 53 IAM credentials for DNS-01 challenge
+#   CERTBOT_AWS_SECRET_ACCESS_KEY - Route 53 IAM credentials for DNS-01 challenge
 
 # RUST_LOG filter shared by lit-actions and lit-api-server.
 # App code stays at trace; per-module overrides suppress low-value internals:
@@ -92,5 +95,36 @@ services:
       - '/sys:/host/sys:ro'
     restart: unless-stopped
 
+  # dstack-ingress — attestation-bound TLS termination inside the TEE.
+  # Obtains a Let's Encrypt cert for DOMAIN via DNS-01 (Route 53), then
+  # reverse-proxies HTTPS :443 → lit-api-server :8000.
+  dstack-ingress:
+    image: dstacktee/dstack-ingress:1.4@sha256:11c0481ca2e3566f514a1c8a2cc69af1e0bb9dab2e4ea49b469c81ec8e7c5c72
+    ports:
+      - "443:443"
+    environment:
+      # dstack-ingress expects DOMAIN, AWS_ACCESS_KEY_ID, and AWS_SECRET_ACCESS_KEY internally.
+      # Route 53 provider docs (env vars, optional role assumption):
+      # https://github.com/Dstack-TEE/dstack-examples/blob/main/custom-domain/dstack-ingress/DNS_PROVIDERS.md
+      DOMAIN: "${CERTBOT_DOMAIN}"
+      GATEWAY_DOMAIN: "_.dstack-base-prod5.phala.network"
+      DNS_PROVIDER: "route53"
+      TARGET_ENDPOINT: "http://lit-api-server:8000"
+      CERTBOT_EMAIL: "admin@litprotocol.com"
+      SET_CAA: "true"
+      AWS_ACCESS_KEY_ID: "${CERTBOT_AWS_ACCESS_KEY_ID}"
+      AWS_SECRET_ACCESS_KEY: "${CERTBOT_AWS_SECRET_ACCESS_KEY}"
+      # Optional: for STS role assumption instead of direct IAM keys
+      # AWS_ROLE_ARN: "${CERTBOT_AWS_ROLE_ARN}"
+      # AWS_REGION: "${CERTBOT_AWS_REGION}"
+    volumes:
+      - /var/run/dstack.sock:/var/run/dstack.sock
+      - cert-data:/etc/letsencrypt
+    depends_on:
+      lit-api-server:
+        condition: service_started
+    restart: unless-stopped
+
 volumes:
   lit-socket:
+  cert-data: