Domains — EnclaveStack

Overview

A domain is a web address for one of your apps, served over HTTPS. EnclaveStack gets and renews the certificate; addresses ending in .localhost get one from its own certificate authority.

When to use it

Put an app on shop.example.com.
Try an app at https://web.localhost.
Several apps on one machine, each on its own address.

How it works

Caddy 2.10: One edge proxy container, created with the first domain, configured by the control plane.
Let’s Encrypt: Public certificates through ACME, by HTTP or, with a DNS zone, by DNS (wildcards too).
EnclaveStack CA: Certificates for .localhost; download the root once to trust it.

The edge listens on ports 80 and 443 and routes each hostname to its app’s private name, following the app’s replicas. Plain HTTP redirects to HTTPS unless you turn that off. Nothing is exposed until you choose the edge’s public address.

Architecture

The edge terminates HTTPS and routes each hostname to its app.

Flows

Adding a domain

Point the hostname at this machine.
Create the domain for an app.
The edge gets a certificate and starts routing; the page shows when it is issued.

Set it up

In the console

Open Domains and choose New domain.
Enter the hostname and choose the app.
Choose Create.

With the CLI

enclave domain create web-local --hostname web.localhost --app web --wait

With OpenTofu

OpenTofu configuration

resource "enclave_domain" "web_local" {
  name     = "web-local"
  hostname = "web.localhost"
  app      = "web"
}

Settings reference

Every setting and output of the OpenTofu resource; the console and the CLI use the same names in their own words. Generated from platform 4d30582.

`enclave_domain`
Name	Type	Use	What it does
`app`	text	required	Name of the app to route to.
`hostname`	text	required	Hostname, e.g. api.example.com or web.localhost. Changing it replaces the domain.
`name`	text	required	Name of the domain: 3–40 lowercase letters, digits or hyphens, starting with a letter. Changing it replaces the domain.
`port`	number	optional	App port (default: the app's port).
`project`	text	optional	The project to create it in. Defaults to the provider's project (ENCLAVE_PROJECT, else default). Changing it replaces the resource.
`redirect_http`	true or false	optional	Redirect plain HTTP to HTTPS.
`tls`	text	optional	auto (Let's Encrypt), internal (EnclaveStack CA) or off. Default: internal for .localhost names, else auto.
`zone`	text	optional	Zone to get the certificate through (ACME DNS-01): no inbound port needed, and the hostname may be a wildcard like *.example.com.
`certificate_expires_at`	text	output	When the current certificate expires (RFC 3339).
`certificate_issuer`	text	output	Who issued the current certificate.
`certificate_state`	text	output	issued, pending, failed or none.
`id`	text	output	Resource ID.
`url`	text	output	Where the app is served.

Limits and security

Good to know

Public certificates need ports 80 and 443 reachable from the internet, or a DNS zone.

Security

Certificates and keys stay on the machine, encrypted where stored.