feat: add dstack-ingress for custom domain TLS (CPL-152)

.github/workflows/deploy-phala.yml

@@ -50,6 +50,7 @@ jobs:
       instance_type: ${{ steps.set.outputs.instance_type }}
       gcp_project_id: ${{ steps.set.outputs.gcp_project_id }}
       node_config: ${{ steps.set.outputs.node_config }}
+      domain: ${{ steps.set.outputs.domain }}
     steps:
       - name: Set deployment target
         id: set
@@ -59,13 +60,15 @@ jobs:
             echo "instance_type=tdx.large" >> "$GITHUB_OUTPUT"
             echo "gcp_project_id=chipotle-dev" >> "$GITHUB_OUTPUT"
             echo "node_config=NodeConfig.main.toml" >> "$GITHUB_OUTPUT"
-            BASE_URL="https://f8fce543471dc9f5f5643aa217422398c36e5edc-8000.dstack-base-prod5.phala.network"
+            echo "domain=api.chipotle.litprotocol.com" >> "$GITHUB_OUTPUT"
+            BASE_URL="https://api.chipotle.litprotocol.com"
           elif [ "${{ github.ref }}" = "refs/heads/next" ]; then
             echo "phala_app_name=chipotle-next" >> "$GITHUB_OUTPUT"
             echo "instance_type=tdx.small" >> "$GITHUB_OUTPUT"
             echo "gcp_project_id=chipotle-next" >> "$GITHUB_OUTPUT"
             echo "node_config=NodeConfig.next.toml" >> "$GITHUB_OUTPUT"
-            BASE_URL="https://969a8c14c9e13420705b19c7246aeed27897e7ea-8000.dstack-base-prod5.phala.network"
+            echo "domain=test.chipotle.litprotocol.com" >> "$GITHUB_OUTPUT"
+            BASE_URL="https://test.chipotle.litprotocol.com"
           else
             echo "Unsupported branch for deployment"
             exit 1
@@ -150,13 +153,28 @@ jobs:
           DIGEST_LIT_API_SERVER=$(cat digest-lit-api-server.txt | tr -d '\n' | sed 's/}[}]*$//')
           DIGEST_LIT_STATIC=$(cat digest-lit-static.txt | tr -d '\n' | sed 's/}[}]*$//')
           DIGEST_OTEL_COLLECTOR=$(cat digest-otel-collector.txt | tr -d '\n' | sed 's/}[}]*$//')
+          DOMAIN="${{ needs.determine-target.outputs.domain }}"
           sed \
             -e "s|\${DOCKER_IMAGE_LIT_ACTIONS}|${{ vars.DOCKER_IMAGE }}-lit-actions@${DIGEST_LIT_ACTIONS}|g" \
             -e "s|\${DOCKER_IMAGE_LIT_API_SERVER}|${{ vars.DOCKER_IMAGE }}-lit-api-server@${DIGEST_LIT_API_SERVER}|g" \
             -e "s|\${DOCKER_IMAGE_LIT_STATIC}|${{ vars.DOCKER_IMAGE }}-lit-static@${DIGEST_LIT_STATIC}|g" \
             -e "s|\${DOCKER_IMAGE_OTEL_COLLECTOR}|${{ vars.DOCKER_IMAGE }}-otel-collector@${DIGEST_OTEL_COLLECTOR}|g" \
             -e "s|\${GCP_PROJECT_ID}|${{ needs.determine-target.outputs.gcp_project_id }}|g" \
+            -e "s|\${CERTBOT_DOMAIN}|${DOMAIN}|g" \
+            -e "s|\${CERTBOT_EMAIL}|${{ secrets.CERTBOT_EMAIL }}|g" \
+            -e "s|\${CERTBOT_AWS_ACCESS_KEY_ID}|${{ secrets.CERTBOT_AWS_ACCESS_KEY_ID }}|g" \
+            -e "s|\${CERTBOT_AWS_SECRET_ACCESS_KEY}|${{ secrets.CERTBOT_AWS_SECRET_ACCESS_KEY }}|g" \
             docker-compose.phala.yml > docker-compose.deploy.yml
+          if [ -z "$DOMAIN" ]; then
+            # No custom domain — remove entire dstack-ingress service and cert-data volume
+            awk '
+              /^  dstack-ingress:/ { skip=1; next }
+              skip && /^  [^ ]/ { skip=0 }
+              skip { next }
+              /^  cert-data:/ { next }
+              { print }
+            ' docker-compose.deploy.yml > docker-compose.deploy.tmp && mv docker-compose.deploy.tmp docker-compose.deploy.yml
+          fi
           cat docker-compose.deploy.yml
 
       - name: Setup Node.js

docker-compose.phala.yml

@@ -14,6 +14,10 @@
 # Required secrets (set as encrypted Phala CVM environment variables):
 #   GCP_SERVICE_ACCOUNT_JSON  - GCP service account key (raw JSON or base64-encoded)
 #   GCP_PROJECT_ID            - GCP project ID (e.g. "my-gcp-project")
+#   CERTBOT_DOMAIN            - Custom domain for TLS (e.g. "api.chipotle.litprotocol.com")
+#   CERTBOT_EMAIL             - Email for Let's Encrypt certificate notifications
+#   CERTBOT_AWS_ACCESS_KEY_ID     - Route 53 IAM credentials for DNS-01 challenge
+#   CERTBOT_AWS_SECRET_ACCESS_KEY - Route 53 IAM credentials for DNS-01 challenge
 
 # RUST_LOG filter shared by lit-actions and lit-api-server.
 # App code stays at trace; per-module overrides suppress low-value internals:
@@ -104,5 +108,35 @@ services:
       ROCKET_PORT: "8001"
     restart: unless-stopped
 
+  # dstack-ingress — attestation-bound TLS termination inside the TEE.
+  # Obtains a Let's Encrypt cert for DOMAIN via DNS-01 (Route 53), then
+  # reverse-proxies HTTPS :443 → lit-api-server :8000.
+  dstack-ingress:
+    image: dstacktee/dstack-ingress:1.4@sha256:11c0481ca2e3566f514a1c8a2cc69af1e0bb9dab2e4ea49b469c81ec8e7c5c72
+    ports:
+      - "443:443"
+    environment:
+      # dstack-ingress expects DOMAIN, AWS_ACCESS_KEY_ID, and AWS_SECRET_ACCESS_KEY internally.
+      # Route 53 provider docs (env vars, optional role assumption):
+      # https://github.com/Dstack-TEE/dstack-examples/blob/main/custom-domain/dstack-ingress/DNS_PROVIDERS.md
+      DOMAIN: "${CERTBOT_DOMAIN}"
+      DNS_PROVIDER: "route53"
+      TARGET_ENDPOINT: "http://lit-api-server:8000"
+      CERTBOT_EMAIL: "${CERTBOT_EMAIL}"
+      SET_CAA: "true"
+      AWS_ACCESS_KEY_ID: "${CERTBOT_AWS_ACCESS_KEY_ID}"
+      AWS_SECRET_ACCESS_KEY: "${CERTBOT_AWS_SECRET_ACCESS_KEY}"
+      # Optional: for STS role assumption instead of direct IAM keys
+      # AWS_ROLE_ARN: "${CERTBOT_AWS_ROLE_ARN}"
+      # AWS_REGION: "${CERTBOT_AWS_REGION}"
+    volumes:
+      - /var/run/dstack.sock:/var/run/dstack.sock
+      - cert-data:/etc/letsencrypt
+    depends_on:
+      lit-api-server:
+        condition: service_started
+    restart: unless-stopped
+
 volumes:
   lit-socket:
+  cert-data: