Verify Custom Domain

Celery tasks for verifying llmclient custom domains.

A custom domain is verified when it is delegated to Smarter and its TLS certificate is issued, which takes two steps, checked in order:

  1. NS delegation: the domain’s public NS records include one of the name servers of its DNS zone, e.g. an AWS Route53 hosted zone, i.e. the customer has delegated the domain to Smarter.

  2. TLS certificate: the domain’s certificate, e.g. an AWS ACM certificate, is ISSUED. The provider validates the certificate with a DNS record in the zone, so it can only be issued after step 1. A certificate is requested if the domain has none.

https itself is served by each LLMClient that uses the domain, on its own subdomain, <llmclient>.<domain>, with its own Kubernetes-managed certificate. The LLMClient’s deployment handles that, not the custom domain’s verification.

Main Tasks

  • verify_custom_domain(hosted_zone_id, sleep_interval=None, max_attempts=None):

    Checks the steps once. If a step is not complete, it records why in the custom domain’s verification_message, and schedules itself to check again, until max_attempts.

The custom domain’s verification_status is Verifying while it is checked, Verified, with verified_at, once its certificate is issued, and Failed if it is still not verified after the last attempt. A domain that is already Verified stays Verified while it is re-verified, until it fails.

Signals

  • pre_verify_custom_domain: Sent before custom domain verification begins.

  • post_verify_custom_domain: Sent after custom domain verification is completed.

Configuration

Celery task behavior (retries, backoff, queue) is controlled by smarter_settings.

Usage

verify_custom_domain.delay(hosted_zone_id, sleep_interval, max_attempts)

raises LLMClientTaskError:

If the DNS zone does not exist.

raises Exception:

Any exception during task execution will trigger a retry according to Celery settings.

smarter.apps.llmclient.tasks.verify_custom_domain.verify_custom_domain(hosted_zone_id=None, sleep_interval=None, max_attempts=None, attempt=0, task_id=None, custom_domain_id=None)

Verify that the custom domain of a DNS zone is delegated to Smarter, and that its TLS certificate is issued.

Each run checks the verification steps once, in order. If a step is not complete, the task records why, and schedules itself to check again in sleep_interval seconds, up to max_attempts times, rather than sleeping, so that it never blocks a Celery worker while DNS changes.

Parameters:

  • hosted_zone_id (str | None) – The id of the DNS zone of the custom domain, e.g. an AWS Route53 hosted zone.

  • custom_domain_id (int | None) – The id of the custom domain, in place of its DNS zone. A custom domain that has no DNS zone, because it has not been registered with smarter deploy, fails at once.

  • sleep_interval (int | None) – The interval in seconds between verification attempts. Default is 1800 (30 minutes).

  • max_attempts (int | None) – The maximum number of verification attempts. Default is calculated for 24 hours.

  • attempt (int) – The number of checks already made. The task passes it when it schedules itself again.

  • task_id (str | None) – The id of the first run, for logging and signals.

Returns:

True if the domain is verified, False if it is not after max_attempts checks, and None if it will be checked again.

Return type:

bool | None