fix: multiple certbot instances

Author: Leechael

custom-domain/dstack-ingress/Dockerfile

@@ -18,7 +18,6 @@ RUN set -e; \
     done && \
     apt-get update && \
     apt-get install -y --no-install-recommends \
-        certbot \
         openssl \
         bash \
         python3-pip \
@@ -32,6 +31,17 @@ RUN set -e; \
 
 RUN mkdir -p /etc/letsencrypt /var/www/certbot /usr/share/nginx/html
 
+# Set up Python virtual environment and install certbot
+RUN set -e; \
+    python3 -m venv --system-site-packages /opt/app-venv && \
+    . /opt/app-venv/bin/activate && \
+    pip install --upgrade pip && \
+    pip install certbot requests && \
+    # Create symlinks for system-wide access
+    ln -sf /opt/app-venv/bin/certbot /usr/local/bin/certbot && \
+    # Ensure the virtual environment is always activated for scripts
+    echo 'source /opt/app-venv/bin/activate' > /etc/profile.d/app-venv.sh
+
 COPY ./scripts /scripts/
 RUN chmod +x /scripts/*.sh /scripts/*.py
 ENV PATH="/scripts:$PATH"

custom-domain/dstack-ingress/scripts/certman.py

@@ -90,9 +90,9 @@ def install_plugin(self) -> bool:
             import pkg_resources
             print(f"Installed to Python: {sys.executable}")
 
-            # Show certbot location
-            certbot_exec = self._get_certbot_executable()
-            print(f"Using certbot: {certbot_exec}")
+            # Show certbot command
+            certbot_cmd = self._get_certbot_command()
+            print(f"Using certbot: {' '.join(certbot_cmd)}")
 
             try:
                 dist = pkg_resources.get_distribution("certbot-dns-namecheap")
@@ -109,8 +109,8 @@ def install_plugin(self) -> bool:
                 print(f"Plugin {self.provider.CERTBOT_PLUGIN} successfully imported")
 
                 # Test if plugin is recognized by certbot
-                certbot_exec = self._get_certbot_executable()
-                test_cmd = [certbot_exec, "plugins"]
+                certbot_cmd = self._get_certbot_command()
+                test_cmd = certbot_cmd + ["plugins"]
                 test_result = subprocess.run(test_cmd, capture_output=True, text=True, timeout=10)
 
                 if test_result.returncode == 0 and "dns-namecheap" in test_result.stdout:
@@ -135,7 +135,7 @@ def install_plugin(self) -> bool:
 
                         if force_result.returncode == 0:
                             # Test again after reinstall
-                            retest_cmd = [certbot_exec, "plugins"]
+                            retest_cmd = certbot_cmd + ["plugins"]
                             retest_result = subprocess.run(retest_cmd, capture_output=True, text=True, timeout=10)
                             if retest_result.returncode == 0 and "dns-namecheap" in retest_result.stdout:
                                 print(f"✓ Plugin registration fixed after reinstall")
@@ -159,25 +159,16 @@ def install_plugin(self) -> bool:
     def _ensure_certbot_in_env(self) -> None:
         """Ensure certbot is installed in the current Python environment."""
         import sys
-        import shutil
-        
-        # Check if certbot is available in current environment
-        python_dir = os.path.dirname(sys.executable)
-        potential_certbot = os.path.join(python_dir, "certbot")
-        
-        if os.path.exists(potential_certbot):
-            print(f"Certbot already available in current environment: {potential_certbot}")
-            return
 
         # Try to import certbot to check if it's installed
         try:
             import certbot
-            print(f"Certbot module available in current environment")
+            print(f"✓ Certbot module available in current environment")
             return
         except ImportError:
-            pass
+            print(f"Certbot module not found, installing...")
 
-        print(f"Installing certbot in current environment...")
+        # Install certbot if not available
         try:
             install_cmd = [sys.executable, "-m", "pip", "install", "certbot"]
             print(f"Running: {' '.join(install_cmd)}")
@@ -187,33 +178,21 @@ def _ensure_certbot_in_env(self) -> None:
                 print(f"✓ Certbot installed successfully in current environment")
             else:
                 print(f"Failed to install certbot: {result.stderr}")
-                # Continue anyway - system certbot might still work
+                # Continue anyway - may still work
         except Exception as e:
             print(f"Error installing certbot: {e}")
-            # Continue anyway - system certbot might still work
+            # Continue anyway - may still work
 
-    def _get_certbot_executable(self) -> str:
-        """Get the correct certbot executable path that matches the Python environment."""
+    def _get_certbot_command(self) -> List[str]:
+        """Get the correct certbot command that uses the same Python environment."""
         import sys
-        import shutil
-        
-        # Try to find certbot in the same environment as the current Python
-        python_dir = os.path.dirname(sys.executable)
-        potential_certbot = os.path.join(python_dir, "certbot")
-        
-        if os.path.exists(potential_certbot):
-            print(f"Found certbot in same environment: {potential_certbot}")
-            return potential_certbot
-        
-        # Try which certbot
-        certbot_path = shutil.which("certbot")
-        if certbot_path:
-            print(f"Found certbot via which: {certbot_path}")
-            return certbot_path
 
-        # Fall back to system certbot
-        print(f"Falling back to system certbot command")
-        return "certbot"
+        # Always use Python module execution to ensure same environment
+        # This guarantees that certbot runs in the same Python environment
+        # where we installed the plugins
+        cmd = [sys.executable, "-m", "certbot"]
+        print(f"Using certbot via Python module: {' '.join(cmd)}")
+        return cmd
 
     def _debug_plugin_registration(self) -> None:
         """Debug why plugin is not being registered by certbot."""
@@ -222,8 +201,8 @@ def _debug_plugin_registration(self) -> None:
             print("=== Plugin Registration Debug ===")
 
             # Show which certbot we're using
-            certbot_exec = self._get_certbot_executable()
-            print(f"Using certbot: {certbot_exec}")
+            certbot_cmd = self._get_certbot_command()
+            print(f"Using certbot: {' '.join(certbot_cmd)}")
 
             # Check entry points
             try:
@@ -292,9 +271,9 @@ def _build_certbot_command(self, action: str, domain: str, email: str) -> List[s
         if not plugin:
             raise ValueError(f"No certbot plugin configured for {self.provider_type}")
 
-        # Use the same certbot executable as the Python environment
-        certbot_exec = self._get_certbot_executable()
-        base_cmd = [certbot_exec, action, "-a", plugin, "--non-interactive", "-v"]
+        # Use Python module execution to ensure same environment
+        certbot_cmd = self._get_certbot_command()
+        base_cmd = certbot_cmd + [action, "-a", plugin, "--non-interactive", "-v"]
 
         # Add credentials file if configured
         if self.provider.CERTBOT_CREDENTIALS_FILE:

custom-domain/dstack-ingress/scripts/entrypoint.sh

@@ -5,18 +5,14 @@ set -e
 PORT=${PORT:-443}
 TXT_PREFIX=${TXT_PREFIX:-"_tapp-address"}
 
-echo "Setting up Python environment"
+echo "Setting up certbot environment"
 
-setup_py_env() {
-    if [ ! -d "/opt/app-venv" ]; then
-        python3 -m venv --system-site-packages /opt/app-venv
-    fi
+setup_certbot_env() {
+    # Activate the pre-built virtual environment
     source /opt/app-venv/bin/activate
 
-    pip install requests
-
     # Use the unified certbot manager to install plugins and setup credentials
-    echo "Setting up certbot environment"
+    echo "Installing DNS plugins and setting up credentials"
     certman.py setup
     if [ $? -ne 0 ]; then
         echo "Error: Failed to setup certbot environment"
@@ -156,8 +152,8 @@ bootstrap() {
 
 # Credentials are now handled by certman.py setup
 
-# Setup Python environment and install dependencies first
-setup_py_env
+# Setup certbot environment (venv is already created in Dockerfile)
+setup_certbot_env
 
 # Check if it's the first time the container is started
 if [ ! -f "/.bootstrapped" ]; then