fix(relay-server): make the config report describe the deployment it checks

Two cases where the report could validate a configuration different from the
one that would actually run.

`--env-file` is documented as inspecting a file instead of the process
environment, but it only set the file's own keys. A relay variable absent from
the file stayed inherited from the shell, and a higher-priority alias in the
shell beat a value the file did supply — process AWS_REGION over file
AWS_DEFAULT_REGION. Compose passes only the file, so the report could describe
a different deployment than the one being checked. The file is now the whole
environment for that pass: every name the deployment understands is cleared
first, the file applied, and the previous environment restored afterwards.
Inspecting the process environment, where isolation is not the intent, is
unchanged.

ACME was reported as enabled whenever the provider and credential looked valid,
including when PORTAL_URL had a local-only host. acme.NewManager returns before
it builds a DNS provider for a local base domain, so managed issuance never
runs in that case and a development certificate is used instead. The report now
treats a configured provider on a local host as blocked, which is what asking
for automation that cannot start should look like. ens-gasless already defers
to acmeFeature, so it inherits the state and the reason.

Both are the mismatch this report exists to surface, so both are covered by
tests that fail when either fix is reverted.

Author: rabbitson87

cmd/relay-server/config.go

@@ -123,6 +123,18 @@ func acmeFeature(cfg relayServerConfig) feature {
 		return f
 	}
 
+	// acme.NewManager returns before it builds a DNS provider when the base
+	// domain is local-only, so managed issuance cannot run however well the
+	// provider is configured. Reporting it as enabled here would describe an
+	// automation that never starts.
+	if host := portalURLHost(cfg.PortalURL); host == "" || utils.IsLocalRelayHost(host) {
+		f.State, f.By = stateBlocked, "ACME_DNS_PROVIDER="+provider
+		f.Missing = fmt.Sprintf(
+			"PORTAL_URL host %q is local-only; managed issuance is skipped for local hosts and a development certificate is used instead",
+			host)
+		return f
+	}
+
 	required, supported := dnsProviderCredential[provider]
 	if !supported {
 		f.State, f.By = stateBlocked, "ACME_DNS_PROVIDER="+provider
@@ -641,6 +653,70 @@ func writeCommentWrapped(w io.Writer, text string) {
 	}
 }
 
+// applyEnvFileInIsolation makes the file the whole environment for the pass
+// that follows, and returns a function restoring what was there before.
+//
+// Setting only the file's own keys is not enough. A relay variable absent from
+// the file would stay inherited from the shell, and a higher-priority alias in
+// the shell would beat a value the file does supply — process AWS_REGION over
+// file AWS_DEFAULT_REGION, for instance. Either way the report would describe a
+// configuration different from the one Compose is going to deploy, which is the
+// opposite of what checking a file is for.
+func applyEnvFileInIsolation(entries []envFileEntry) (func(), error) {
+	// A first pass populates the registry, which is how the set of names the
+	// deployment understands is known at all.
+	if _, err := resolveRelayServerConfig(nil); err != nil {
+		return nil, err
+	}
+
+	names := make([]string, 0, len(externalEnvVars))
+	for _, entry := range utils.EnvVars() {
+		names = append(names, entry.Name)
+		names = append(names, entry.Aliases...)
+	}
+	for name := range externalEnvVars {
+		names = append(names, name)
+	}
+	for _, entry := range entries {
+		names = append(names, entry.Name)
+	}
+
+	type saved struct {
+		value string
+		set   bool
+	}
+	previous := make(map[string]saved, len(names))
+	restore := func() {
+		for name, prior := range previous {
+			if prior.set {
+				_ = os.Setenv(name, prior.value)
+				continue
+			}
+			_ = os.Unsetenv(name)
+		}
+	}
+
+	for _, name := range names {
+		if _, recorded := previous[name]; recorded {
+			continue
+		}
+		value, set := os.LookupEnv(name)
+		previous[name] = saved{value: value, set: set}
+		if err := os.Unsetenv(name); err != nil {
+			restore()
+			return nil, fmt.Errorf("isolate %s: %w", name, err)
+		}
+	}
+
+	for _, entry := range entries {
+		if err := os.Setenv(entry.Name, entry.Value); err != nil {
+			restore()
+			return nil, fmt.Errorf("apply %s: %w", entry.Name, err)
+		}
+	}
+	return restore, nil
+}
+
 func runConfigCommand(args []string) error {
 	var (
 		envFilePath string
@@ -661,20 +737,18 @@ func runConfigCommand(args []string) error {
 		return err
 	}
 
-	// Load the file before registering flags: flag defaults resolve from the
-	// process environment, which is exactly how Compose delivers env_file.
 	var entries []envFileEntry
 	source := "process environment"
 	if strings.TrimSpace(envFilePath) != "" {
 		loaded, err := loadEnvFile(envFilePath)
 		if err != nil {
 			return fmt.Errorf("read env file: %w", err)
 		}
-		for _, entry := range loaded {
-			if err := os.Setenv(entry.Name, entry.Value); err != nil {
-				return fmt.Errorf("apply %s: %w", entry.Name, err)
-			}
+		restore, err := applyEnvFileInIsolation(loaded)
+		if err != nil {
+			return err
 		}
+		defer restore()
 		entries = loaded
 		source = envFilePath
 	}

cmd/relay-server/config_test.go

@@ -0,0 +1,165 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// writeEnvFile writes lines to a temporary env file and returns its path.
+func writeEnvFile(t *testing.T, lines ...string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "test.env")
+	body := strings.Join(lines, "\n") + "\n"
+	if err := os.WriteFile(path, []byte(body), 0o600); err != nil {
+		t.Fatalf("write env file: %v", err)
+	}
+	return path
+}
+
+// resolveWithEnvFile runs the same isolation the config subcommand performs and
+// returns the resulting configuration.
+func resolveWithEnvFile(t *testing.T, path string) relayServerConfig {
+	t.Helper()
+	entries, err := loadEnvFile(path)
+	if err != nil {
+		t.Fatalf("load env file: %v", err)
+	}
+	restore, err := applyEnvFileInIsolation(entries)
+	if err != nil {
+		t.Fatalf("isolate env file: %v", err)
+	}
+	defer restore()
+
+	cfg, err := resolveRelayServerConfig(nil)
+	if err != nil {
+		t.Fatalf("resolve config: %v", err)
+	}
+	return cfg
+}
+
+func featureByName(t *testing.T, cfg relayServerConfig, name string) feature {
+	t.Helper()
+	for _, f := range evaluateFeatures(cfg) {
+		if f.Name == name {
+			return f
+		}
+	}
+	t.Fatalf("feature %q not reported", name)
+	return feature{}
+}
+
+// A variable absent from the env file must not leak in from the surrounding
+// shell: Compose passes only the file, so a report that saw the shell would be
+// describing a different deployment.
+func TestEnvFileIsolationIgnoresInheritedValue(t *testing.T) {
+	t.Setenv("DISCOVERY", "true")
+
+	cfg := resolveWithEnvFile(t, writeEnvFile(t, "PORTAL_URL=https://relay.example.com"))
+
+	if cfg.DiscoveryEnabled {
+		t.Fatal("DISCOVERY was inherited from the process environment; the file did not set it")
+	}
+}
+
+// A higher-priority alias in the shell must not beat a value the file supplies
+// through a lower-priority name.
+func TestEnvFileIsolationBeatsHigherPriorityAlias(t *testing.T) {
+	t.Setenv("AWS_REGION", "us-east-1")
+
+	cfg := resolveWithEnvFile(t, writeEnvFile(t, "AWS_DEFAULT_REGION=ap-northeast-2"))
+
+	if cfg.AWSRegion != "ap-northeast-2" {
+		t.Fatalf("AWS region = %q, want the file value ap-northeast-2", cfg.AWSRegion)
+	}
+}
+
+func TestEnvFileIsolationRestoresEnvironment(t *testing.T) {
+	t.Setenv("DISCOVERY", "true")
+	if err := os.Unsetenv("BOOTSTRAPS"); err != nil {
+		t.Fatalf("unset BOOTSTRAPS: %v", err)
+	}
+
+	entries, err := loadEnvFile(writeEnvFile(t, "BOOTSTRAPS=https://seed.example.com"))
+	if err != nil {
+		t.Fatalf("load env file: %v", err)
+	}
+	restore, err := applyEnvFileInIsolation(entries)
+	if err != nil {
+		t.Fatalf("isolate env file: %v", err)
+	}
+	restore()
+
+	if got := os.Getenv("DISCOVERY"); got != "true" {
+		t.Fatalf("DISCOVERY = %q after restore, want true", got)
+	}
+	if _, set := os.LookupEnv("BOOTSTRAPS"); set {
+		t.Fatal("BOOTSTRAPS is set after restore; it was unset before")
+	}
+}
+
+// acme.NewManager returns before building a DNS provider for a local-only base
+// domain, so a configured provider still yields no managed issuance.
+func TestACMEFeatureBlockedForLocalHost(t *testing.T) {
+	cfg := relayServerConfig{
+		PortalURL:       "https://localhost",
+		ACMEDNSProvider: "cloudflare",
+		CloudflareToken: "token",
+	}
+
+	f := featureByName(t, cfg, "acme")
+	if f.State != stateBlocked {
+		t.Fatalf("acme state = %q, want %q", f.State, stateBlocked)
+	}
+	if !strings.Contains(f.Missing, "local-only") {
+		t.Fatalf("acme missing = %q, want it to name the local-only host", f.Missing)
+	}
+}
+
+// ens-gasless drives the same provider, so it must inherit the blocked state
+// rather than repeating half of the check.
+func TestENSGaslessFollowsBlockedACME(t *testing.T) {
+	cfg := relayServerConfig{
+		PortalURL:         "https://localhost",
+		ACMEDNSProvider:   "cloudflare",
+		CloudflareToken:   "token",
+		ENSGaslessEnabled: true,
+	}
+
+	f := featureByName(t, cfg, "ens-gasless")
+	if f.State != stateBlocked {
+		t.Fatalf("ens-gasless state = %q, want %q", f.State, stateBlocked)
+	}
+	if !strings.Contains(f.Missing, "local-only") {
+		t.Fatalf("ens-gasless missing = %q, want the ACME reason propagated", f.Missing)
+	}
+}
+
+func TestACMEFeatureEnabledForPublicHost(t *testing.T) {
+	cfg := relayServerConfig{
+		PortalURL:       "https://relay.example.com",
+		ACMEDNSProvider: "cloudflare",
+		CloudflareToken: "token",
+	}
+
+	f := featureByName(t, cfg, "acme")
+	if f.State != stateEnabled {
+		t.Fatalf("acme state = %q, want %q (missing: %s)", f.State, stateEnabled, f.Missing)
+	}
+}
+
+func TestACMEFeatureBlockedWithoutCredential(t *testing.T) {
+	cfg := relayServerConfig{
+		PortalURL:       "https://relay.example.com",
+		ACMEDNSProvider: "cloudflare",
+	}
+
+	f := featureByName(t, cfg, "acme")
+	if f.State != stateBlocked {
+		t.Fatalf("acme state = %q, want %q", f.State, stateBlocked)
+	}
+	if !strings.Contains(f.Missing, "CLOUDFLARE_TOKEN") {
+		t.Fatalf("acme missing = %q, want it to name the credential", f.Missing)
+	}
+}