Two new ways to get a certificate, both aimed at holding fewer DNS credentials.

Highlights

• CHALLENGE_TYPE=tls-alpn-01 (#105) — issue with no DNS credentials at all. The CA validates over port 443; haproxy peeks at the ALPN and forwards acme-tls/1 to lego, everything else to the TLS frontend. The operator creates the records once; DNS_SETUP_MODE picks whether the container waits for them, just prints them, or POSTs them to a webhook (signed with HMAC-SHA256 and a TDX quote over the payload). Wildcards are not available in this mode — RFC 8737 does not allow them.
• DELEGATION_ZONE (#104, #108) — full delegation for dns-01. Every name the deployment needs is aliased into a zone your token controls, so the token needs no access to the served domain's own zone. You create three CNAMEs once, before deploying, and never touch DNS again — not when the app id changes, not when the ACME account is recreated, not when the gateway moves. Wildcards need a fourth, because RFC 8659 evaluates CAA at the base.

Also in this release

• haproxy now reloads only on an actual renewal (#102). 2.2 treated every renewal check as a renewal, so it regenerated evidence and reloaded haproxy every 12 hours whether or not anything changed.
• The ACME contact address is optional. 2.2 always passed --email; leave ACME_EMAIL unset for a contactless account, which matters because the address is published in the evidence.
• Renewal is configurable: RENEW_INTERVAL (default 12h, 2.2's hard-coded cadence) and RENEW_DAYS_BEFORE.
• CERTBOT_EMAIL → ACME_EMAIL, CERTBOT_STAGING → ACME_STAGING. The old names still work.
• The evidence server binds to loopback. Still served at https://<domain>/evidences/; only a deployment that published the container's port 80 itself is affected.

See TESTING.md for how this release was exercised.

Docker Image Digest (SHA256)

git-launcher image (SHA256)

• Image: docker.io/dstacktee/git-launcher:0.3.0
• Digest: sha256:4437dce18ec713b0991d34bd926d324966b1a0b90fad485b8ddb3f4ed2af138b
• Verification: https://search.sigstore.dev/?hash=sha256:4437dce18ec713b0991d34bd926d324966b1a0b90fad485b8ddb3f4ed2af138b

git-launcher image (SHA256)

• Image: docker.io/dstacktee/git-launcher:0.2.0
• Digest: sha256:70b32e7929233865f354b8e3f329737deb78415def9b87a4a567b2e06e254bbe
• Verification: https://search.sigstore.dev/?hash=sha256:70b32e7929233865f354b8e3f329737deb78415def9b87a4a567b2e06e254bbe

git-launcher image (SHA256)

• Image: docker.io/dstacktee/git-launcher:0.1.0
• Digest: sha256:9a9d61abd4d9176ecc8b9f318e3b08fde5eec11f988fd83981d87c0f5d8a2c87
• Verification: https://search.sigstore.dev/?hash=sha256:9a9d61abd4d9176ecc8b9f318e3b08fde5eec11f988fd83981d87c0f5d8a2c87

trusted-workload-launcher image (SHA256)

• Image: docker.io/dstacktee/trusted-workload-launcher:0.1.0
• Digest: sha256:211d3922f21a9ec6fac252db2cc703a5d3412973509655c9f91f3036c6101afb
• Verification: https://search.sigstore.dev/?hash=sha256:211d3922f21a9ec6fac252db2cc703a5d3412973509655c9f91f3036c6101afb

Docker Image Digest (SHA256)

Docker Image Digest (SHA256)

Docker Image Digest (SHA256)

Docker Image Digest (SHA256)

Docker Image Digest (SHA256)

What's Changed

• ingress: Better CERTBOT_STAGING handling by @kvinwang in #68
• ingress: Correct propagation option for other providers by @kvinwang in #70
• added custom domain route53 provider to dstack ingress by @wwwehr in #73
• fix(namecheap): Fix XML namespace and DNSRecord type conversion by @amiller in #76
• custom domain nginx reverse proxy header size by @wwwehr in #78
• fix(ingress): re-obtain certificate when switching between staging and production by @kvinwang in #81
• fix(ingress): enable unbuffered Python output for real-time logging by @kvinwang in #82

Full Changelog: dstack-ingress-v1.2...dstack-ingress-v1.3