Domains and HTTPS

Point a domain at the server, add it to a project and get a certificate without manual steps.

After this page the project opens at your domain over HTTPS. The agent on your server issues and renews the certificate through Let's Encrypt.

Before you start

What	How to check
The project runs	The panel status is Running
The domain is yours	You can change DNS records at the registrar or DNS host
Ports 80 and 443 are open	The provider firewall lets inbound 80 and 443 through

If the server has no public address, read tunnel behind NAT: there the domain is connected with a CNAME record.

At the domain registrar create an A record with your server address. For www create a second A record or a CNAME to the main domain. If the server has IPv6, add AAAA too.

Type	Name	Value
`A`	`app.example.com`	`203.0.113.10`
`A`	`www.app.example.com`	`203.0.113.10`

dig +short A app.example.com

The command should return the server address. Usually it takes minutes, with some registrars up to several hours.

In the panel open the project, the Settings tab, the Domains field. Separate several domains with spaces or commas. Tick “Redirect www to the apex domain” if www. should lead to the main address. Click Save and deploy.

The agent updates the proxy and issues a certificate. Usually it takes under a minute once DNS points at the server.

The same in nolay.toml:

[proxy]
domains = ["app.example.com"]
redirect_www = true

Wildcards like *.example.com are not supported: list each subdomain separately.
Domains are written in lowercase.
HTTP redirects to HTTPS with code 308. Turn it off with protection.https_redirect.
Certificates live on the server in /var/lib/nolay/caddy and survive an agent reinstall.
Let's Encrypt limits failed attempts per domain per hour. If the certificate was not issued, fix DNS first and only then save again.

curl -I https://app.example.com

The answer has HTTP/2 200 or your app's code. The certificate log on the server:

docker logs nolay-caddy --tail 50

A successful issue is the line certificate obtained successfully.

What you see	Why	What to do
Status “Running, but unreachable from outside”	DNS does not point at the server yet, or 80 and 443 are closed	Check `dig` and the provider firewall
A certificate error in the browser	The certificate is not issued yet	See `docker logs nolay-caddy`; DNS is the usual cause
Projects with domains fail	Another process holds ports 80 and 443	`ss -lptn 'sport = :80 or sport = :443'`, free the ports

Set the secrets and tune domain protection with the [protection] fields.