Skip to main content

​
Adding a Domain

Custom domains are bound to a specific service port. When you add a domain:
  1. Point your domain’s DNS to your edge hostname.
  2. Add the domain in the service port settings.
  3. The platform automatically provisions a TLS certificate via Let’s Encrypt.
Traffic flows: Internet → Proxy Node → Traefik (TLS) → WireGuard → Container.

​
Automatic Subdomains

Configure Automatic Subdomain Domain under Settings → Infrastructure to offer automatic domains in service networking settings. For example, with the setting configured as apps.example.com, a service whose private hostname is project-api-production can use project-api-production.apps.example.com. Create a wildcard CNAME record for *.apps.example.com that points to your edge hostname. The setting contains only the base domain, without *. or a protocol. Custom domains remain available alongside automatic domains.

​
TLS Certificates

Certificates are provisioned using the ACME HTTP-01 challenge. The control plane handles the challenge validation — Traefik routes /.well-known/acme-challenge/* requests back to the control plane. Certificates are:
  • Issued automatically when a domain is added.
  • Stored in the database and distributed to all proxy nodes.
  • Renewed automatically before expiration.

​
Multiple Proxy Nodes

When using multiple proxy nodes for geographic distribution, all proxies share the same TLS certificates from the control plane. A stable external load balancer with active health checks is the ideal production solution for proxy failure. Configure every proxy as an origin, point the edge hostname to the load balancer, and point custom domains to the edge hostname. Health-aware GeoDNS is an alternative, but failover remains subject to DNS and client caching. Plain multiple A records provide best-effort distribution and do not guarantee that clients avoid an offline proxy. See the Architecture page for details.

​
Protocols

Each service port specifies a protocol: For HTTP ports, you can optionally bind a custom domain. For TCP/UDP ports, traffic is exposed via an external port on the proxy node.