feat(gateway): let a ZT domain validate with dns-persist-01

A gateway CVM running dns-01 holds a Cloudflare token with write access to
the operator's whole zone. Attestation covers what the CVM runs, not what
becomes of a secret it holds, so that token is the widest credential in the
deployment and it exists only to write one TXT record per order.
dns-persist-01 removes it: control comes from a `_validation-persist` record
the operator publishes once, and the CVM never gets DNS write access at all.

`ZtDomainConfig.challenge` picks the method per domain and defaults to
dns-01, so records written before the field existed decode as the method
those deployments were using -- pinned by a test over both the named and the
legacy positional msgpack encodings. Such a domain needs no DNS credential,
and `validation_for` never looks one up for it.

`GetZtDomain` and `ListZtDomains` return the records to publish in
`required_dns_records`, rendered from the stored account URI with no ACME
round trip so the listing endpoints stay cheap; it comes back empty rather
than failing when no account exists yet.

Two operations cannot be self-service for such a domain, and say so rather
than failing silently:

- `SetCaa` skips it and logs the records instead. There is nothing to
  reconcile without write access, and one such domain must not make the RPC
  unusable for the dns-01 domains beside it; the summary reports how many
  were left to the operator.
- `RotateAcmeCredentials` moves the cluster to a new account while every
  `_validation-persist` record still names the old one, so orders for those
  domains fail until the operator republishes. The response now carries the
  new records in `required_dns_records`, rendered after the switch so they
  name the account the cluster actually moved to, and `domains_updated`
  counts only the domains whose CAA was re-pinned.

Author: kvinwang

dstack/gateway/rpc/proto/gateway_rpc.proto

@@ -210,6 +210,10 @@ message RotateAcmeCredentialsResponse {
   string account_uri = 1;
   // Number of ZT domains whose CAA records were updated for the new account.
   uint32 domains_updated = 2;
+  // Zone-file lines an operator must publish by hand, for domains the gateway
+  // cannot write (dns-persist-01). Non-empty means issuance for those domains
+  // stays broken until they name the new account.
+  repeated string required_dns_records = 3;
 }
 
 // Get HostInfo for associated instance id.
@@ -742,6 +746,14 @@ message ZtDomainConfig {
   optional uint32 node = 4;
   // Priority for default base_domain selection (higher = preferred)
   int32 priority = 5;
+  // ACME challenge proving control of this domain: "dns-01" (default) or
+  // "dns-persist-01". Empty means "dns-01".
+  //
+  // "dns-persist-01" needs no DNS credential: control comes from a
+  // _validation-persist TXT record the operator publishes once, so the gateway
+  // CVM never holds write access to the zone. Experimental — the draft is still
+  // changing and Let's Encrypt serves it on staging only.
+  string challenge = 6;
 }
 
 // ZT-Domain information (config + certificate status)
@@ -750,6 +762,10 @@ message ZtDomainInfo {
   ZtDomainConfig config = 1;
   // Certificate status
   ZtDomainCertStatus cert_status = 2;
+  // Zone-file lines the domain's DNS must contain. Under "dns-01" the gateway
+  // writes these itself and they are informational; under "dns-persist-01" they
+  // are the one-time setup an operator has to publish.
+  repeated string required_dns_records = 3;
 }
 
 // ZT-Domain certificate status

dstack/gateway/src/admin_service.rs

@@ -6,6 +6,7 @@ use std::sync::atomic::Ordering;
 use std::time::{Duration, SystemTime, UNIX_EPOCH};
 
 use anyhow::{bail, ensure, Context, Result};
+use certbot::ChallengeKind;
 use dstack_gateway_rpc::{
     admin_server::{AdminRpc, AdminServer},
     CertAttestationInfo, CertbotConfigResponse, ClearInstancePortPolicyRequest,
@@ -110,10 +111,11 @@ impl AdminRpc for AdminRpcHandler {
     }
 
     async fn rotate_acme_credentials(self) -> Result<RotateAcmeCredentialsResponse> {
-        let (account_uri, domains_updated) = self.state.rotate_acme_credentials().await?;
+        let outcome = self.state.rotate_acme_credentials().await?;
         Ok(RotateAcmeCredentialsResponse {
-            account_uri,
-            domains_updated: domains_updated.try_into().unwrap_or(u32::MAX),
+            account_uri: outcome.account_uri,
+            domains_updated: outcome.domains_updated.try_into().unwrap_or(u32::MAX),
+            required_dns_records: outcome.required_dns_records,
         })
     }
 
@@ -554,11 +556,15 @@ impl AdminRpc for AdminRpcHandler {
     async fn list_zt_domains(self) -> Result<ListZtDomainsResponse> {
         let kv_store = self.state.kv_store();
         let cert_resolver = &self.state.cert_resolver;
+        let certbot = &self.state.certbot;
 
         let domains = kv_store
             .list_zt_domain_configs()
             .into_iter()
-            .map(|config| zt_domain_to_proto(config, kv_store, cert_resolver))
+            .map(|config| {
+                let records = certbot.required_dns_records(&config);
+                zt_domain_to_proto(config, kv_store, cert_resolver, records)
+            })
             .collect();
 
         Ok(ListZtDomainsResponse { domains })
@@ -573,7 +579,8 @@ impl AdminRpc for AdminRpcHandler {
             .get_zt_domain_config(&domain)
             .context("ZT-Domain config not found")?;
 
-        Ok(zt_domain_to_proto(config, kv_store, cert_resolver))
+        let records = self.state.certbot.required_dns_records(&config);
+        Ok(zt_domain_to_proto(config, kv_store, cert_resolver, records))
     }
 
     async fn add_zt_domain(self, request: ProtoZtDomainConfig) -> Result<ZtDomainInfo> {
@@ -591,7 +598,8 @@ impl AdminRpc for AdminRpcHandler {
         kv_store.save_zt_domain_config(&config)?;
         info!("Added ZT-Domain config: {}", config.domain);
 
-        Ok(zt_domain_to_proto(config, kv_store, cert_resolver))
+        let records = self.state.certbot.required_dns_records(&config);
+        Ok(zt_domain_to_proto(config, kv_store, cert_resolver, records))
     }
 
     async fn update_zt_domain(self, request: ProtoZtDomainConfig) -> Result<ZtDomainInfo> {
@@ -608,7 +616,8 @@ impl AdminRpc for AdminRpcHandler {
         kv_store.save_zt_domain_config(&config)?;
         info!("Updated ZT-Domain config: {}", config.domain);
 
-        Ok(zt_domain_to_proto(config, kv_store, cert_resolver))
+        let records = self.state.certbot.required_dns_records(&config);
+        Ok(zt_domain_to_proto(config, kv_store, cert_resolver, records))
     }
 
     async fn delete_zt_domain(self, request: DeleteZtDomainRequest) -> Result<()> {
@@ -976,20 +985,33 @@ fn proto_to_zt_domain_config(
         bail!("port must be between 1 and 65535");
     }
 
+    // Empty means the historical default: every ZT domain predates the choice.
+    let challenge = match proto.challenge.as_str() {
+        "" | "dns-01" => ChallengeKind::Dns01,
+        "dns-persist-01" => ChallengeKind::DnsPersist01,
+        other => bail!("unsupported challenge {other:?}, expected dns-01 or dns-persist-01"),
+    };
+
     Ok(ZtDomainConfig {
         domain,
         dns_cred_id,
         port: proto.port.try_into().context("port out of range")?,
         node: proto.node,
         priority: proto.priority,
+        challenge,
     })
 }
 
 /// Convert internal ZtDomainConfig to proto ZtDomainInfo (with cert status)
+///
+/// `required_dns_records` is best effort: rendering it needs the ACME account
+/// URI, and a domain whose ACME client cannot be built yet still has to be
+/// listable. It comes back empty in that case rather than failing the call.
 fn zt_domain_to_proto(
     config: ZtDomainConfig,
     kv_store: &crate::kv::KvStore,
     cert_resolver: &crate::cert_store::CertResolver,
+    required_dns_records: Vec<String>,
 ) -> ZtDomainInfo {
     // Get certificate data for status
     let cert_data = kv_store.get_cert_data(&config.domain);
@@ -1003,15 +1025,22 @@ fn zt_domain_to_proto(
         loaded_in_memory,
     });
 
+    let challenge = match config.challenge {
+        ChallengeKind::Dns01 => "dns-01",
+        ChallengeKind::DnsPersist01 => "dns-persist-01",
+    };
+
     ZtDomainInfo {
         config: Some(ProtoZtDomainConfig {
             domain: config.domain,
             dns_cred_id: config.dns_cred_id,
             port: config.port.into(),
             node: config.node,
             priority: config.priority,
+            challenge: challenge.to_string(),
         }),
         cert_status,
+        required_dns_records,
     }
 }