Domains
A hostname that routes to your app, with a TLS certificate issued and renewed for you.
What it is
A domain is the public address of an app. You give klickops a hostname and the app it belongs to, and klickops routes traffic to it, issues a certificate, and renews that certificate before it expires. There is nothing to configure in the container.
Every domain belongs to exactly one app. That is deliberate: a hostname is a facet of the app it points at, so you manage it from the app's Domains tab rather than from a separate list of routing rules.
When you'd use it
- Your app should be reachable from a browser.
- You want HTTPS without touching a certificate file.
- You are moving a hostname from another provider and want the certificate to exist before you cut the DNS over.
Reaching another workload inside the same project needs no domain. Apps in a project reach each other by name over the internal network, and giving an internal service a public hostname just widens its exposure.
Get a hostname
There are two ways, and the first one needs no DNS at all.
A klickops subdomain. Toggle it on and klickops assigns one under its own wildcard, resolving immediately with a certificate already valid. On the hosted service the label is a random slug rather than your project's name, so nothing about your tenancy ends up in public DNS. Self-hosted installs use the readable app.project.your-base-domain form instead.
Your own domain. Add the hostname, then point it at klickops.
- Open the app, go to Domains, and add the hostname you own.
- klickops shows the DNS record to create. A
CNAMEfor a subdomain, or the address record for an apex. - Create that record with your DNS provider. A wildcard
CNAMEcovers every subdomain at once if you plan to add more. - Wait for the check to go green. klickops polls DNS and issues the certificate as soon as the record resolves, usually within a minute or two.
Add the domain before you move production traffic. The certificate is issued once DNS resolves, so cutting over after the check goes green means no window where visitors see a warning.
Settings reference
| Setting | Default | What it does |
|---|---|---|
| Hostname | none | The name visitors type. One domain resource per hostname. |
| App | required | Which app receives the traffic, and on which port. |
| TLS | on | Issues and renews a certificate. Leave it on. |
| Redirect to HTTPS | on | Sends plaintext requests to the secure address. |
| Access | public | public serves everyone. sso puts sign-in in front of the app, so an internal tool needs no auth code of its own. |
| Path | / | Route only a prefix to this app, when several apps share one hostname. |
Limits and gotchas
- One hostname, one domain resource. The controller in front does not merge two definitions of the same host, so a duplicate hostname is rejected rather than silently half-applied.
- Certificates need public DNS. The issuer proves you control the name over the internet. A hostname that only resolves on your internal network cannot get a public certificate.
- Apex domains need an address record. Most DNS providers cannot
CNAMEan apex. Use their alias record type, or pointwwwat klickops and redirect the apex to it. - Removing a domain is immediate. Traffic stops the moment it is deleted, so move DNS first if the name is live.
Related
- Apps is what a domain points at.
- A domain gives the app an address; the project firewall controls who may use it.