Domains & TLS

Four lines publish a service on a domain with a certificate.

HTTP routing

services:
  api:
    image: ghcr.io/acme/api:1.4
    port: 8080
    http:
      domain: api.acme.com
      path: /            # default

Point the domain's A record at your server's IP (or use one wildcard record, *.example.com, to cover every app you'll ever deploy). The route is served by Envoy on ports 80/443; the certificate is issued via Let's Encrypt (HTTP-01) and renewed automatically. Nothing to configure, nothing to cron.

jekyo status <app> shows each URL and its certificate state, including "certificate pending" right after the first deploy while issuance completes (usually under a minute once DNS resolves).

Turning TLS off

    http:
      domain: internal.example.com
      tls: false

Useful for internal hostnames or clusters installed without --domain (there's no ACME account to issue from in that case).

Multiple services, multiple domains

Each service carries its own http block, so one app can serve api.acme.com and admin.acme.com from different services, each with its own certificate.

Raw TCP/UDP

Not everything is HTTP. expose publishes a port directly on the node:

services:
  game:
    image: acme/game-server
    expose:
      - port: 27015
        node: 30015      # NodePort range 30000-32767
        protocol: udp

Redirects

A domain that only redirects (www to apex, old domain to new) needs no container. Declare a service with nothing but http:

services:
  www:
    http:
      domain: www.example.com
      redirect: example.com

The ingress itself answers with a permanent redirect (301), the path is preserved, and the domain still gets its own TLS certificate. Use a full URL (https://other.example) to control the scheme.