# Domains and HTTPS

URL: https://docs.nolay.ru/en/guides/domains/
Updated: 2026-09-23

> Point a domain at the server, add it to a project and get a certificate without manual steps.

After this page the project opens at your domain over HTTPS. The agent on your server issues and renews the certificate through Let's Encrypt.

## Before you start

| What | How to check |
|---|---|
| The project runs | The panel status is Running |
| The domain is yours | You can change DNS records at the registrar or DNS host |
| Ports 80 and 443 are open | The provider firewall lets inbound 80 and 443 through |

If the server has no public address, read [tunnel behind NAT](/en/guides/tunnel/): there the domain is connected with a CNAME record.

## Steps

1. At the domain registrar create an `A` record with your server address. For `www` create a second `A` record or a `CNAME` to the main domain. If the server has IPv6, add `AAAA` too.

| Type | Name | Value |
|---|---|---|
| `A` | `app.example.com` | `203.0.113.10` |
| `A` | `www.app.example.com` | `203.0.113.10` |

2. Wait for the record to work. Check from any computer:

```sh
dig +short A app.example.com
```

The command should return the server address. Usually it takes minutes, with some registrars up to several hours.

3. In the panel open the project, the Settings tab, the Domains field. Separate several domains with spaces or commas. Tick “Redirect www to the apex domain” if `www.` should lead to the main address. Click Save and deploy.

![Domains are set in the project settings, one or several separated by spaces.](https://docs.nolay.ru/shots/en/project-domains-light.png)

4. The agent updates the proxy and issues a certificate. Usually it takes under a minute once DNS points at the server.

The same in `nolay.toml`:

```toml
[proxy]
domains = ["app.example.com"]
redirect_www = true
```

## Good to know

- Wildcards like `*.example.com` are not supported: list each subdomain separately.
- Domains are written in lowercase.
- HTTP redirects to HTTPS with code 308. Turn it off with `protection.https_redirect`.
- Certificates live on the server in `/var/lib/nolay/caddy` and survive an agent reinstall.
- Let's Encrypt limits failed attempts per domain per hour. If the certificate was not issued, fix DNS first and only then save again.

## Check

```sh
curl -I https://app.example.com
```

The answer has `HTTP/2 200` or your app's code. The certificate log on the server:

```sh
docker logs nolay-caddy --tail 50
```

A successful issue is the line `certificate obtained successfully`.

## Troubleshooting

| What you see | Why | What to do |
|---|---|---|
| Status “Running, but unreachable from outside” | DNS does not point at the server yet, or 80 and 443 are closed | Check `dig` and the provider firewall |
| A certificate error in the browser | The certificate is not issued yet | See `docker logs nolay-caddy`; DNS is the usual cause |
| Projects with domains fail | Another process holds ports 80 and 443 | `ss -lptn 'sport = :80 or sport = :443'`, free the ports |

## Next

Set the [secrets](/en/guides/secrets/) and tune domain protection with the [`[protection]`](/en/reference/nolay-toml/#field-protection) fields.