Domains and TLS certificates

On a Server, each Domain is a Traefik route to one Service, with a certificate from Let’s Encrypt, one you upload, or none. In a Cloud account, a Domain sits on the cloud’s own load balancer or CDN with the cloud’s own certificate. Either way, you create the DNS record; Cloudgate shows you which one and checks it.

What you can do

• Add your own hostname, such as shop.northwind.example, to an Application or a Compose stack.
• Get a free sslip.io hostname with no DNS at all.
• Serve over HTTPS with Let’s Encrypt, a stored certificate, or a certificate resolver of your own.
• Route only a path, such as /api, and strip it before the request reaches the container.
• Redirect URLs with a regular expression, and protect an Application with basic authentication.
• Run behind a CDN or proxy that you configure yourself.

Add a custom domain on a Server

1. Open the Domains tab

   Open the Application, for example web in storefront / production, and its Domains tab. Press Add a domain.

   cloudgate.octabyte.app/applications/…/domains

   

2. Enter the host

   In Host, type the hostname visitors use: shop.northwind.example. No scheme, no path. Set Container port to the port your app listens on.

   To answer on only part of the host, set Path. /api takes /api and everything under it, but not /apix; leave it at / for the whole host. Turn on Strip the path before proxying if your app expects requests without that prefix.

   cloudgate.octabyte.app/applications/…/domains

   

3. Choose HTTPS and a certificate

   Leave Serve over HTTPS on: Traefik then redirects HTTP to HTTPS and terminates TLS. Under Certificate, pick one:

   Certificate	What it does
   Let’s Encrypt	Issued automatically once DNS points at the Server.
   Stored certificate	Served from Settings > Certificates; add it there first. A wildcard counts.
   Custom resolver	A certificate resolver you configured on the Server’s Traefik, named in Traefik resolver.
   None	No certificate. For a host behind a CDN that terminates TLS, turn HTTPS off instead.

   A stored certificate that covers the host always wins over a resolver.

4. Create the DNS record

   The console shows The record to create at your DNS provider: an A record whose name is the part in front of your zone (shop for shop.northwind.example) and whose value is the Server’s public address. Create it, then press Check DNS.

5. Save

   Press Add domain. Changes reach Traefik as soon as they are saved.

The Application now answers at https://shop.northwind.example. Let’s Encrypt issues the certificate on the first request after the record resolves; DNS changes can take a while to spread.

Use a free sslip.io address

In the Add a domain dialog, press Generate one for me next to Host. Cloudgate writes a hostname such as web.203.0.113.10.sslip.io. sslip.io answers from the name itself, so there is no record to create and it works at once.

The Get started wizard makes one of these for you. That address is plain HTTP; add your own domain for HTTPS. Generate one for me needs the Server’s public address to be recorded.

Upload your own certificate

For a host Let’s Encrypt cannot issue for, open Settings > Certificates > Add a certificate. Give it a name, paste the PEM certificate chain and the private key. The private key is never shown again. Then choose Stored certificate on the Domain.

Redirect a URL

Open the Application’s Advanced tab, then Routing > Redirects > Add a redirect.

• Match this: a Go regular expression matched against the whole URL, for example ^https://northwind\.example/(.*).
• Send it here: where to send it. Capture groups are ${1}, ${2} and so on, for example https://shop.northwind.example/${1}.
• Permanent (301): off sends a 302.

To ask for a password before the Application, use Basic authentication on the same tab. A saved password is never sent back to the browser; editing a user replaces it.

Put a CDN in front of a Service

Cloudgate has no CDN integration: you set the CDN up at your provider. When you check DNS for a host behind Cloudflare, Bunny CDN, Fastly or Arvancloud, Cloudgate recognises the provider and says it cannot see past the proxy to check the origin. Make sure the CDN’s own origin is the Server’s address.

If the CDN terminates TLS itself, turn Serve over HTTPS off on the Domain, so Traefik does not ask Let’s Encrypt for a certificate it cannot get.

Add a domain in a Cloud account

A Service in a Cloud account is always served over HTTPS with the cloud’s own certificate (ACM on AWS, Google-managed on Google Cloud). Open the Service’s Domains tab and press Add a domain.

1. Enter the host

   Type the host, such as shop.northwind.example, and an optional Path, then press Add domain.

2. Create the records it shows

   The row shows the validation record for the certificate and the record that points the host at the cloud. On AWS a subdomain gets a CNAME; a bare name needs an ALIAS, ANAME or flattened CNAME, never an A record. Create them at your DNS provider.

3. Wait for Live

   The Domain moves through Waiting for DNS, Checking and Live, or Failed with the reason. Each change runs as its own short Deployment.

Until a Domain is added, a Cloud Run Service answers at its run.app address and an AWS static site at its CloudFront name. A static site on Google Cloud has no address of its own.

What you cannot do

Related pages

• Applications: the Services that take Domains.
• Monitoring: add an Uptime check and an Error-rate threshold on a Domain.
• SSO and SCIM: put a Domain behind forward auth.
• Servers: the Traefik a Domain runs on, and request metrics.
• Cloud accounts: load balancers and CDNs in AWS and Google Cloud.
• Everything Cloudgate runs in production.

Questions

Does Cloudgate create DNS records for me?

No. Cloudgate never writes DNS. The console shows the record to create at your DNS provider and checks it once you have.

Is the free sslip.io address served over HTTPS?

The address the Get started wizard makes is plain HTTP. Add your own domain to serve the Application over HTTPS.

Can I put Cloudflare or another CDN in front?

Yes, but Cloudgate has no CDN integration. The DNS check recognises Cloudflare, Bunny CDN, Fastly and Arvancloud and stops at the proxy. If the CDN terminates TLS, turn Serve over HTTPS off.

What happens to DNS when I remove a Domain?

Nothing. Removing a Domain removes only the route in Cloudgate. Delete the record at your DNS provider yourself.