feat: add dstack-ingress for custom domain TLS (CPL-152)

.github/workflows/deploy-phala.yml

@@ -50,6 +50,7 @@ jobs:
       instance_type: ${{ steps.set.outputs.instance_type }}
       gcp_project_id: ${{ steps.set.outputs.gcp_project_id }}
       node_config: ${{ steps.set.outputs.node_config }}
+      domain: ${{ steps.set.outputs.domain }}
     steps:
       - name: Set deployment target
         id: set
@@ -59,7 +60,8 @@ jobs:
             echo "instance_type=tdx.large" >> "$GITHUB_OUTPUT"
             echo "gcp_project_id=chipotle-dev" >> "$GITHUB_OUTPUT"
             echo "node_config=NodeConfig.main.toml" >> "$GITHUB_OUTPUT"
-            BASE_URL="https://f8fce543471dc9f5f5643aa217422398c36e5edc-8000.dstack-base-prod5.phala.network"
+            echo "domain=api.chipotle.litprotocol.com" >> "$GITHUB_OUTPUT"
+            BASE_URL="https://api.chipotle.litprotocol.com"
           elif [ "${{ github.ref }}" = "refs/heads/next" ]; then
             echo "phala_app_name=chipotle-next" >> "$GITHUB_OUTPUT"
             echo "instance_type=tdx.small" >> "$GITHUB_OUTPUT"
@@ -150,13 +152,32 @@ jobs:
           DIGEST_LIT_API_SERVER=$(cat digest-lit-api-server.txt | tr -d '\n' | sed 's/}[}]*$//')
           DIGEST_LIT_STATIC=$(cat digest-lit-static.txt | tr -d '\n' | sed 's/}[}]*$//')
           DIGEST_OTEL_COLLECTOR=$(cat digest-otel-collector.txt | tr -d '\n' | sed 's/}[}]*$//')
+          DOMAIN="${{ needs.determine-target.outputs.domain }}"
           sed \
             -e "s|\${DOCKER_IMAGE_LIT_ACTIONS}|${{ vars.DOCKER_IMAGE }}-lit-actions@${DIGEST_LIT_ACTIONS}|g" \
             -e "s|\${DOCKER_IMAGE_LIT_API_SERVER}|${{ vars.DOCKER_IMAGE }}-lit-api-server@${DIGEST_LIT_API_SERVER}|g" \
             -e "s|\${DOCKER_IMAGE_LIT_STATIC}|${{ vars.DOCKER_IMAGE }}-lit-static@${DIGEST_LIT_STATIC}|g" \
             -e "s|\${DOCKER_IMAGE_OTEL_COLLECTOR}|${{ vars.DOCKER_IMAGE }}-otel-collector@${DIGEST_OTEL_COLLECTOR}|g" \
             -e "s|\${GCP_PROJECT_ID}|${{ needs.determine-target.outputs.gcp_project_id }}|g" \
+            -e "s|\${DOMAIN}|${DOMAIN}|g" \
+            -e "s|\${CERTBOT_EMAIL}|${{ secrets.CERTBOT_EMAIL }}|g" \
+            -e "s|\${AWS_ACCESS_KEY_ID}|${{ secrets.AWS_ACCESS_KEY_ID_ROUTE53 }}|g" \
+            -e "s|\${AWS_SECRET_ACCESS_KEY}|${{ secrets.AWS_SECRET_ACCESS_KEY_ROUTE53 }}|g" \
             docker-compose.phala.yml > docker-compose.deploy.yml
+          if [ -n "$DOMAIN" ]; then
+            # Strip profiles: line so dstack-ingress starts unconditionally
+            # (phala deploy doesn't support compose profiles)
+            sed -i '/profiles:/d' docker-compose.deploy.yml
+          else
+            # No custom domain — remove entire dstack-ingress service and cert-data volume
+            awk '
+              /^  dstack-ingress:/ { skip=1; next }
+              skip && /^  [^ ]/ { skip=0 }
+              skip { next }
+              /^  cert-data:/ { next }
+              { print }
+            ' docker-compose.deploy.yml > docker-compose.deploy.tmp && mv docker-compose.deploy.tmp docker-compose.deploy.yml
+          fi
           cat docker-compose.deploy.yml
 
       - name: Setup Node.js

docker-compose.phala.yml

@@ -14,6 +14,10 @@
 # Required secrets (set as encrypted Phala CVM environment variables):
 #   GCP_SERVICE_ACCOUNT_JSON  - GCP service account key (raw JSON or base64-encoded)
 #   GCP_PROJECT_ID            - GCP project ID (e.g. "my-gcp-project")
+#   DOMAIN                    - Custom domain for TLS (e.g. "api.chipotle.litprotocol.com")
+#   CERTBOT_EMAIL             - Email for Let's Encrypt certificate notifications
+#   AWS_ACCESS_KEY_ID         - Route 53 IAM credentials for DNS-01 challenge
+#   AWS_SECRET_ACCESS_KEY     - Route 53 IAM credentials for DNS-01 challenge
 
 # RUST_LOG filter shared by lit-actions and lit-api-server.
 # App code stays at trace; per-module overrides suppress low-value internals:
@@ -104,5 +108,30 @@ services:
       ROCKET_PORT: "8001"
     restart: unless-stopped
 
+  # dstack-ingress — attestation-bound TLS termination inside the TEE.
+  # Obtains a Let's Encrypt cert for DOMAIN via DNS-01 (Route 53), then
+  # reverse-proxies HTTPS :443 → lit-api-server :8000.
+  dstack-ingress:
+    profiles: ["custom-domain"]
+    image: dstacktee/dstack-ingress:1.4@sha256:11c0481ca2e3566f514a1c8a2cc69af1e0bb9dab2e4ea49b469c81ec8e7c5c72
+    ports:
+      - "443:443"
+    environment:
+      DOMAIN: "${DOMAIN}"
+      DNS_PROVIDER: "route53"
+      TARGET_ENDPOINT: "http://lit-api-server:8000"
+      CERTBOT_EMAIL: "${CERTBOT_EMAIL}"
+      SET_CAA: "true"
+      AWS_ACCESS_KEY_ID: "${AWS_ACCESS_KEY_ID}"
+      AWS_SECRET_ACCESS_KEY: "${AWS_SECRET_ACCESS_KEY}"
+    volumes:
+      - /var/run/dstack.sock:/var/run/dstack.sock
+      - cert-data:/etc/letsencrypt
+    depends_on:
+      lit-api-server:
+        condition: service_started
+    restart: unless-stopped
+
 volumes:
   lit-socket:
+  cert-data: