Add a domain
Put a hostname you own in front of an app, and serve it over HTTPS.
Deplo is still in beta
Rough edges are expected. The official 1.0 release is planned for Q4 2026.
What it is
With a certificate Deplo gets for you automatically.
How it works
- A domain in Deplo is one row, keyed on hostname plus path, and it's the only thing the routing renderer reads. Adding one gives Traefik on that server a router whose rule is
Host(...), pointing at your container. - The certificate is a separate choice on the same row. A brand new domain is created with no certificate, on plain HTTP, and you opt into TLS by picking a provider. Nothing is ever registered with Let's Encrypt behind your back.
- Deplo checks the DNS itself, on a schedule and on demand. A hostname is only routed once that check returns
valid, or returnscloudflarefor a name proxied through Cloudflare.
Point the domain at the server
Find the server's public IP
It's on the server card in Settings -> Servers, and it's also the hexadecimal part of the app's generated nip.io URL.
Create an A record
At your DNS provider, create an A record for the hostname, pointing at that IP. For app.example.com on 203.0.113.10:
Type Name Value TTL
A app 203.0.113.10 autoGive it a minute
DNS caches, and Deplo will keep checking.
Add it in Deplo
Open Domains
Open the app and go to Domains.
Add a domain
Click Add Domain.
Type the hostname
For example app.example.com.
Turn on HTTPS
Open Advanced settings, then the HTTPS group, and set Certificate to Let's Encrypt.
Confirm
Click Add domain.
Wait for DNS
The row shows Waiting for DNS until the record resolves to this server. It becomes routable on its own once it does.
Set it as primary
Open the row's menu and choose Set as primary. The primary hostname is the one shown in the app header and used as the production URL.
The certificate issues on first visit
Traefik requests the certificate the first time somebody loads the site over HTTPS. It takes a few seconds, and renews itself from then on.
No domain yet?
The Add Domain dialog has a Generate button that mints another free nip.io hostname on the spot. Useful for a second entry point, a staging name, or just a shorter URL than the generated one. It can't hold a certificate, so it stays on plain HTTP.
Limits and gotchas
- A
nip.iohostname can never get a certificate. It's one registered domain shared with the whole internet, and its issuance budget is shared with it. Use a domain you own for HTTPS. - Behind Cloudflare's orange cloud, pick Cloudflare. Deplo detects a proxied domain and selects it for you. The DNS check then reads
cloudflare, meaning proxied and therefore unverifiable from here, not confirmed. It's routed anyway, because a correct orange-cloud setup could never verify. - Let's Encrypt validates over HTTP. Port 80 must be reachable from the internet even for a site you only intend to serve on 443.
- 50 Let's Encrypt domains per team. Every team on this instance shares one ACME account, so the cap stops one team from exhausting the budget for everyone. Domains with no certificate don't count.
- One hostname belongs to one team. Another team can't claim
app.example.comonce you have it, and the same is true of a preview base domain. - The same hostname can serve two apps on different paths.
example.com/andexample.com/apiare two rows and may point at two different apps. That's a feature, and a path router always wins over a whole-host one.
If it does not work
Common failures
- Stuck on Waiting for DNS. The record hasn't propagated, or it points at a different machine. Check with
dig +short app.example.com. - The browser shows a certificate warning. The certificate hasn't issued. Almost always port 80 is closed, or the domain resolves elsewhere.
- 404 from Traefik. The domain resolves and the certificate is fine, but no router matches. Usually the app is stopped, or the domain sits on an app running on a different server.
- More in Domains and TLS.
See also
Did this page help you?