Domains

Base domains

A base domain, such as example.com, is a domain routes are made under. Each one also has an internal name (internal.example.com, answered only on your mesh) and a preview name. A domain must be verified before routes can use it: add the TXT record _meshploy-verify.<domain> the domain’s page shows, then check.

Every verified base domain serves routes. One gateway can serve several.

The primary domain

One base domain is primary. It decides where the platform itself answers: the console, the API, and the address new machines join the mesh through. It is also what a new route defaults to.

Make primary moves the platform to another domain without breaking anything. The platform keeps answering on the old one, marked former primary, until you remove it, because the console you are using and every node’s control address depend on it. A former primary cannot be removed while a node or a git connection still uses it; its page says which.

DNS modes

Each base domain has its own DNS mode:

• Delegation: the domain’s name servers point at the gateway, which answers for it and holds one wildcard certificate for every name. Nothing to add per route.
• On-demand: DNS stays with your provider. Each hostname needs a record pointing at the gateway, and gets its own certificate the first time it is asked for.

An on-demand domain’s records can also be kept by a connected DNS provider such as Cloudflare. Meshploy then writes them, the domain needs no TXT record to verify, and its wildcard certificates, internal ones included, are issued up front as on a delegated domain.

A base domain can also be reserved for one project, on its page under Projects. Then only that project and its environment levels can put routes on it, and other projects are not offered it. The primary domain, and a former primary, serve every project’s console names, so they cannot be reserved; and a domain other projects already have routes on can be reserved only once those routes have moved. A project cannot be deleted while a domain is reserved for it: give the domain back to every project, or remove it, first.

Retiring a domain

A domain that has served routes is removed in two steps: retire it, which stops new routes choosing it while existing ones keep serving, then move those routes and remove it.

Terms

• Primary: The domain the platform itself answers on: the console, the API, and where nodes join. More
• Former primary: The domain the primary moved away from. It keeps serving the platform until nothing uses it, then can be removed. More
• Delegation: The domain’s name servers point at the gateway, which answers for it and covers every name with one wildcard certificate. More
• Reserved for a project: Only that project and its environment levels may put routes on the domain; no other project is offered it. More
• On-demand: DNS stays with your provider; each hostname needs its own record and gets its own certificate. More