> ## Documentation Index
> Fetch the complete documentation index at: https://docs.techulus.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Custom Domains

> Bind custom domains with automatic HTTPS.

## Adding a Domain

Custom domains are bound to a specific service port. When you add a domain:

1. Point your domain's DNS to your edge hostname.
2. Add the domain in the service port settings.
3. The platform automatically provisions a TLS certificate via Let's Encrypt.

Traffic flows: `Internet → Proxy Node → Traefik (TLS) → WireGuard → Container`.

## Automatic Subdomains

Configure **Automatic Subdomain Domain** under **Settings → Infrastructure** to
offer automatic domains in service networking settings. For example, with the
setting configured as `apps.example.com`, a service whose private hostname is
`project-api-production` can use `project-api-production.apps.example.com`.

Create a wildcard `CNAME` record for `*.apps.example.com` that points to your
edge hostname. The setting contains only the base domain, without `*.` or a
protocol. Custom domains remain available alongside automatic domains.

## TLS Certificates

Certificates are provisioned using the ACME HTTP-01 challenge. The control plane handles the challenge validation — Traefik routes `/.well-known/acme-challenge/*` requests back to the control plane.

Certificates are:

* Issued automatically when a domain is added.
* Stored in the database and distributed to all proxy nodes.
* Renewed automatically before expiration.

## Multiple Proxy Nodes

When using multiple proxy nodes for geographic distribution, all proxies share the same TLS certificates from the control plane.

A stable external load balancer with active health checks is the ideal production
solution for proxy failure. Configure every proxy as an origin, point the edge
hostname to the load balancer, and point custom domains to the edge hostname.

Health-aware GeoDNS is an alternative, but failover remains subject to DNS and
client caching. Plain multiple A records provide best-effort distribution and do
not guarantee that clients avoid an offline proxy. See the
[Architecture](/architecture#multiple-proxy-nodes) page for details.

## Protocols

Each service port specifies a protocol:

| Protocol | Description |
| - | - |
| `http` | HTTP/HTTPS traffic routed through Traefik |
| `tcp` | Raw TCP traffic — see [TCP/UDP Proxy](/networking/tcp-udp-proxy) |
| `udp` | Raw UDP traffic — see [TCP/UDP Proxy](/networking/tcp-udp-proxy) |

For HTTP ports, you can optionally bind a custom domain. For TCP/UDP ports, traffic is exposed via an external port on the proxy node.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.