fix(tls): wait for DNS before ACME issuance

packages/ts-cloud/src/drivers/shared/compute-deploy.tsmodified+14-2

Changes to packages/ts-cloud/src/drivers/shared/compute-deploy.ts

		⋯15 linesShow the 15 lines above this hunk@@ -16,7 +16,7 @@ import { buildNginxVhostScript, resolveNginxSnippet } from './nginx-vhost'
16	16	import { resolveNotifications, sendNotifications } from './notifications'
17	17	import { buildPhpFpmPoolScript, phpFpmPoolListen } from './php-fpm-pool'
18	18	import { buildDeployHistoryHeader, buildSiteOwnerGuard } from './releases'
19		-import { buildRpxConfig, buildRpxFragmentRefreshScript, buildRpxLbConfig, buildRpxProvisionScript, rpxCertRenewServiceName, usesRpxProxy } from './rpx-gateway'
	19	+import { buildRpxConfig, buildRpxFragmentRefreshScript, buildRpxLbConfig, buildRpxProvisionScript, certDomainsForConfig, rpxCertRenewServiceName, usesRpxProxy } from './rpx-gateway'
20	20
21	21	export interface ComputeDeployLogger {
22	22	info(message: string): void
		⋯11 linesShow the 11 lines above this hunk@@ -34,6 +34,10 @@ const noopLogger: ComputeDeployLogger = {
34	34	success: () => {},
35	35	}
36	36
	37	+function shellQuote(value: string): string {
	38	+ return `'${value.replace(/'/g, `'"'"'`)}'`
	39	+}
	40	+
37	41	/**
38	42	* Deploy a single site release tarball to compute targets via the active driver.
39	43	*/
		⋯772 linesShow the 772 lines above this hunk@@ -812,6 +816,8 @@ export async function renewRpxCertificates(
812	816
813	817	const rpxConfig = buildRpxConfig(routeSource.sites || {}, { proxy, slug: config.project.slug })
814	818	if (rpxConfig.proxies.length === 0) return true
	819	+ const certDomains = certDomainsForConfig(rpxConfig)
	820	+ if (certDomains.length === 0) return true
815	821
816	822	const slug = config.project.slug
817	823	const stackName = resolveProjectStackName(config, environment)
		⋯9 linesShow the 9 lines above this hunk@@ -827,9 +833,15 @@ export async function renewRpxCertificates(
827	833	}
828	834
829	835	logger.step('Issuing rpx TLS certificates after DNS reconciliation...')
	836	+ const certChecks = certDomains
	837	+ .map(domain => `test -s ${shellQuote(`${rpxConfig.productionCerts.certsDir}/${domain}.crt`)}`)
	838	+ .join(' && ')
830	839	const result = await driver.runRemoteDeploy({
831	840	targets,
832		- commands: [`systemctl start ${rpxCertRenewServiceName(slug)}`],
	841	+ commands: [
	842	+ `systemctl start ${rpxCertRenewServiceName(slug)}`,
	843	+ certChecks,
	844	+ ],
833	845	comment: `ts-cloud rpx TLS issuance ${slug}`,
834	846	tags: {
835	847	Project: slug,

packages/ts-cloud/src/drivers/shared/rpx-gateway.tsmodified+20-1

Changes to packages/ts-cloud/src/drivers/shared/rpx-gateway.ts

		⋯745 linesShow the 745 lines above this hunk@@ -746,10 +746,29 @@ export function buildCertManagementCommands(options: BuildRpxProvisionOptions):
746	746	`EMAIL='${email}'`,
747	747	`TLSX="${tlsxCli}"`,
748	748	`DOMAINS='${csv}'`,
	749	+ "DNS_ATTEMPTS='24'",
	750	+ "DNS_DELAY_SECONDS='5'",
	751	+ 'wait_for_dns() {',
	752	+ ' d="$1"',
	753	+ ' attempt=1',
	754	+ ' while ! getent ahosts "$d" >/dev/null 2>&1; do',
	755	+ ' if [ "$attempt" -ge "$DNS_ATTEMPTS" ]; then',
	756	+ ' echo "DNS for $d did not become resolvable after $DNS_ATTEMPTS attempts" >&2',
	757	+ ' return 1',
	758	+ ' fi',
	759	+ ' echo "Waiting for public DNS before ACME: $d (attempt $attempt/$DNS_ATTEMPTS)"',
	760	+ ' sleep "$DNS_DELAY_SECONDS"',
	761	+ ' attempt=$((attempt + 1))',
	762	+ ' done',
	763	+ '}',
749	764	'before=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',
750	765	`for d in ${spaced}; do`,
751	766	' if [ ! -s "$CERTS/$d.crt" ]; then',
752		- ' $TLSX acme:issue -d "$d" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $d failed (non-fatal)"',
	767	+ ' if wait_for_dns "$d"; then',
	768	+ ' $TLSX acme:issue -d "$d" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $d failed (non-fatal)"',
	769	+ ' else',
	770	+ ' echo "issue $d skipped until DNS resolves (non-fatal)"',
	771	+ ' fi',
753	772	' # rpx reloads its SNI set when a PEM appears. Complete that reload',
754	773	' # before the next hostname starts http-01, or :80 can disappear in',
755	774	' # the middle of the following challenge on a multi-domain deploy.',

packages/ts-cloud/test/drivers/compute-deploy.test.tsmodified+4-1

Changes to packages/ts-cloud/test/drivers/compute-deploy.test.ts

		⋯546 linesShow the 546 lines above this hunk@@ -547,7 +547,10 @@ describe('renewRpxCertificates', () => {
547	547	expect(ok).toBe(true)
548	548	const call = (driver.runRemoteDeploy as ReturnType<typeof mock>).mock.calls[0][0]
549	549	expect(call.targets[0].id).toBe('i-abc123')
550		- expect(call.commands).toEqual(['systemctl start rpx-cert-renew-my-app.service'])
	550	+ expect(call.commands).toEqual([
	551	+ 'systemctl start rpx-cert-renew-my-app.service',
	552	+ "test -s '/etc/rpx/certs/my-app.example.com.crt'",
	553	+ ])
551	554	expect(call.tags.Role).toBe('app')
552	555	})
553	556

packages/ts-cloud/test/drivers/rpx-gateway.test.tsmodified+4-0

Changes to packages/ts-cloud/test/drivers/rpx-gateway.test.ts

		⋯767 linesShow the 767 lines above this hunk@@ -768,6 +768,10 @@ describe('managed TLS (acmeChallengeWebroot + cert renewal)', () => {
768	768	expect(joined).toContain('acme:renew')
769	769	expect(joined).toContain('--webroot')
770	770	expect(joined).toContain(DEFAULT_ACME_WEBROOT)
	771	+ expect(joined).toContain('while ! getent ahosts "$d"')
	772	+ expect(joined).toContain("DNS_ATTEMPTS='24'")
	773	+ expect(joined).toContain("DNS_DELAY_SECONDS='5'")
	774	+ expect(joined.indexOf('wait_for_dns "$d"')).toBeLessThan(joined.indexOf('$TLSX acme:issue'))
771	775	expect(joined).toContain(`[ -s "$CERTS/$d.crt" ] && systemctl restart ${RPX_SERVICE_NAME}`)
772	776	expect(joined.indexOf(`systemctl restart ${RPX_SERVICE_NAME}`)).toBeLessThan(joined.indexOf('acme:renew'))
773	777	// Per-app renewal units (slug defaults to 'app').