Yes, I think we agree that I already answered that.
I did not explicitly cover this, sorry. For ingress/download you can either accept whatever comes out of the internet (any party along the full path that is the originally sending computer and any router along the way in any involved network may set/modify the DSCP value). Unless you have agreements with all parties in place it is unlikely that the DSCPs received from the ISP are going to be all the useful (but do not trust me here, take a packet capture and see what reaches your router). This is why qosify, cake-qos-simple and dscpclassify all got created, to help making sure DSCPs on ingress can be used easily.
Sure:
config queue 'eth1'
option ingress_ecn 'ECN'
option egress_ecn 'ECN'
option itarget 'auto'
option etarget 'auto'
option verbosity '5'
option qdisc 'cake'
option script 'layer_cake.qos'
option qdisc_advanced '1'
option squash_dscp '0'
option squash_ingress '0'
option qdisc_really_really_advanced '1'
option eqdisc_opts 'nat dual-srchost memlimit 32mb'
option linklayer 'ethernet'
option linklayer_advanced '1'
option tcMTU '2047'
option tcTSIZE '128'
option linklayer_adaptation_mechanism 'default'
option debug_logging '1'
option iqdisc_opts 'nat dual-dsthost ingress memlimit 32mb'
option interface 'pppoe-wan'
option tcMPU '88'
option enabled '1'
option overhead '34'
option download '105000'
option upload '45500'
This is on a VDS2/PTM link with a download sync of 116790 and an upload sync of 46719 kbit/s . I note that I use layer_cake/diffserv3 here, but I use neither qosify nor any other option, incoming DSCPs are mostly in BestEffort, which is just as I like it...