Refactor CF SaaS backend and custom domain service for improved DNS handling

- Simplified the `CfSaasBackend` class by removing the `worker_origin` parameter and normalizing CNAME and delegation targets.
- Enhanced the registration process to append ownership verification TXT records when returned by the CF API.
- Introduced a new `dns_preflight` module to check CNAME propagation and detect Cloudflare DNS usage, preventing unnecessary CF API calls.
- Updated `CustomDomainService` to enforce DNS preflight checks before domain registration.
- Modified the domain verification method picker to prioritize CF HTTP DCV for custom domains.
- Added unit tests for DNS preflight checks and custom domain resolution to ensure proper functionality and error handling.

Author: Zingzy

app.py

@@ -44,6 +44,7 @@
     StaticCacheHeadersMiddleware,
     configure_cors,
 )
+from middleware.tenant import TenantMiddleware
 from repositories.indexes import ensure_indexes
 from routes.api_v1 import router as api_v1_router
 from routes.auth import router as auth_router
@@ -239,7 +240,9 @@ async def docs(request: Request):
     app.add_middleware(
         MaxContentLengthMiddleware, max_content_length=settings.max_content_length
     )
-    # 5. Request logging — innermost, logs all requests with request_id
+    # 5. Tenant resolution — populates request.state.tenant from Host
+    app.add_middleware(TenantMiddleware)
+    # 6. Request logging — innermost, logs all requests with request_id
     app.add_middleware(RequestLoggingMiddleware)
 
     # ── Error handlers + rate limiter ────────────────────────────────────

caddy/Caddyfile

@@ -79,9 +79,12 @@ qr.spoo.me {
 	}
 }
 
-# CF SaaS fallback origin. CF polls this to keep the origin Active
-# (prereq for Custom Hostname registrations). mTLS via AOP required.
-proxy-fallback.spoo.me {
+# Custom-domain catch-all. CF SaaS terminates TLS at the edge, then
+# dispatches to this listener via the zone fallback_origin
+# (proxy-fallback.spoo.me) with SNI = proxy-fallback.spoo.me and Host
+# = customer fqdn. AOP client cert gates origin access; the app reads
+# the Host header to scope the lookup to the right tenant.
+:443 {
 	tls /etc/caddy/origin.crt /etc/caddy/origin.key {
 		protocols tls1.2 tls1.3
 		client_auth {
@@ -98,23 +101,3 @@ proxy-fallback.spoo.me {
 		header_up X-Forwarded-For {client_ip}
 	}
 }
-
-# CF Worker → origin hop for custom domains (see cloudflare-worker/).
-# Plain HTTP because Workers can't attach AOP. Shared secret gates auth;
-# Host gets rewritten from X-Forwarded-Host so the app builds absolute
-# URLs against the customer hostname.
-:80 {
-	log
-	header {
-		-Server
-	}
-	@authed header X-Worker-Auth {env.WORKER_AUTH_SECRET}
-	handle @authed {
-		reverse_proxy app:8000 {
-			header_up X-Real-IP {client_ip}
-			header_up X-Forwarded-For {client_ip}
-			header_up Host {http.request.header.X-Forwarded-Host}
-		}
-	}
-	respond 403
-}

cloudflare-worker/README.md

@@ -151,7 +151,9 @@ class CustomDomainSettings(BaseSettings):
     # is config, not abuse). Validators below fail container startup instead.
     max_per_user: int = Field(default=1, ge=1)
     create_attempts_per_day: int = Field(default=3, ge=1)
-    verify_attempts_per_hour: int = Field(default=5, ge=1)
+    # Generous because CF's own DCV cadence can take 5-15 min per probe;
+    # legitimate users may poll many times during initial activation.
+    verify_attempts_per_hour: int = Field(default=60, ge=1)
 
     # Re-register cooldown after a user revokes their own domain — discourages
     # rapid hostname-cycling abuse against the LE rate limit. Zero allowed
@@ -187,32 +189,16 @@ class CustomDomainSettings(BaseSettings):
     # enabled (e.g. <random>.dcv.cloudflare.com). Customer adds
     # _acme-challenge.<fqdn> CNAME to <fqdn>.<this value> so CF can renew.
     cf_dcv_delegation_target: str = ""
-    # Hostname CF SaaS dispatches per-Custom-Hostname traffic to. Must match
-    # the Worker route pattern on the SaaS zone — Worker catches dispatched
-    # traffic and proxies to the actual origin. Usually same as
-    # cf_cname_target, kept separate so the user-facing CNAME and the
-    # internal dispatch hostname can diverge if needed.
-    cf_worker_origin: str = "customers.spoo.me"
     # Retry policy for CF API calls. Three attempts with exponential backoff.
     cf_api_max_retries: int = Field(default=3, ge=1)
     cf_api_initial_backoff_seconds: float = Field(default=1.0, gt=0)
 
     @model_validator(mode="after")
     def _validate_cf_saas_config(self) -> CustomDomainSettings:
-        # Normalise at config boundary so backend code can trust the value.
-        self.cf_worker_origin = self.cf_worker_origin.strip().strip(".")
-        if self.cf_zone_id:
-            missing = []
-            if not self.cf_api_token:
-                missing.append("cf_api_token")
-            if not self.cf_dcv_delegation_target:
-                missing.append("cf_dcv_delegation_target")
-            if not self.cf_worker_origin:
-                missing.append("cf_worker_origin")
-            if missing:
-                raise ValueError(
-                    f"CF SaaS path requires {missing} when cf_zone_id is set."
-                )
+        if self.cf_zone_id and not self.cf_api_token:
+            raise ValueError(
+                "CF SaaS path requires cf_api_token when cf_zone_id is set."
+            )
         return self
 
 

cloudflare-worker/deploy.sh

@@ -196,7 +196,6 @@ def wire_services(app: FastAPI, settings: AppSettings, redis_client) -> None:
             custom_domain_repo=custom_domain_repo,
             cname_target=cd_settings.cf_cname_target,
             dcv_delegation_target=cd_settings.cf_dcv_delegation_target,
-            worker_origin=cd_settings.cf_worker_origin,
         )
         # Same instance fills three protocol slots — wiring contract.
         verifiers = {
@@ -230,4 +229,7 @@ def wire_services(app: FastAPI, settings: AppSettings, redis_client) -> None:
         tenant_resolver=tenant_resolver,
         blocked_domain_repo=blocked_domain_repo,
         redis_client=redis_client,
+        preflight_cname_target=cd_settings.cf_cname_target
+        if cd_settings.cf_zone_id
+        else None,
     )