Domains and TLS
Fix DNS, certificate, routing, and panel access problems.
DNS is missing or points to the wrong server
| State | Means | Fix |
|---|---|---|
pending | No record found at all | Create the records the row prints: the A, and the AAAA when the server has IPv6 |
misconfigured | It resolves, but somewhere else | Point it at this app's server. The row prints the record that is wrong |
Check it yourself:
dig +short app.example.com # A records (IPv4)
dig +short AAAA app.example.com # AAAA records (IPv6)No output means propagation or a typo. A different address means the record still points to another host, proxy, or wildcard.
A wrong AAAA breaks a correct A. If the A record is right and the domain is
still misconfigured, an AAAA points at another machine. Remove it, or point
it at the server's IPv6. A server with no IPv6 needs no AAAA at all.
The server matters
An app running on server B needs its domain pointing at B, not at the machine the panel runs on.
Cloudflare shows error 522
Cloudflare cannot reach the server. The usual cause is a hostname with only an AAAA record on a server that has no IPv6: Cloudflare can only dial it over IPv6, and nothing answers.
- Add an A record pointing at the server, proxied like the AAAA.
- Or give the server an IPv6 first, then keep the AAAA.
Ports 80 and 443 closed on the server give the same error.
The browser shows a certificate warning
Check these first:
- Port 80 is open. Let's Encrypt validates over HTTP.
- DNS resolves from the server. Fix the record, then Reload the app or redeploy.
- The domain is not
deplo.site. Use a domain you own for a certificate. - Certificate is set to Let's Encrypt. Check the domain's HTTPS group, above Advanced.
A custom certificate is not being served
- It never loaded. Check the intermediate chain and that the key matches. Otherwise the proxy serves its default certificate.
- It is on the wrong server. Certificates are per host. Add it to every server that runs the app.
- The domain is set to None. A domain with no certificate is on plain HTTP and will never pick one up.
- It expired. Nothing renews a custom certificate. The certificates page warns for the last three weeks.
The domain returns 404
The request reached the proxy, but no route matched. Check:
| Check | Why |
|---|---|
| Is the app running? | A stopped app has no container to route to |
| Is the domain on the right app? | One hostname can route by path, but each path must match |
| Is DNS routable? | Only valid and cloudflare are routed |
| Is it the right server? | DNS decides which machine receives the request |
| For a Compose app, is Container set? | The router needs to know which service |
The domain redirects in a loop
This is usually Flexible mode combined with an HTTPS redirect. Switch to Full or Full (strict) and give the domain a real certificate here.
Two apps share a hostname
example.com/ and example.com/api may point at different apps. The longest
matching path wins.
If the wrong app answers, check Internal path and Strip path before forwarding on both rows.
A hostname cannot be added
One hostname belongs to one team. If another team already holds it, it cannot be added here. The same applies to a preview base domain.
The panel is unreachable
Try the generated address (like https://deplo-cb00710a.deplo.site). If it works, fix the
address in Settings -> Deplo. The browser warns about its certificate once.
If that is silent too, the proxy is down. From the server itself:
curl http://127.0.0.1:3000/api/health # the panel, past the proxy
docker ps
docker logs deplo-traefik
docker logs deplo-deplo-1If the proxy is down, tunnel to the panel:
ssh -L 3000:localhost:3000 [email protected] # then open http://localhost:3000Next steps
Did this page help you?