Domains and TLS

Two host namesCopy Anchor Link

A pod answers on two host names:

The installer derives the console's host from --domain by adding -admin to the first label:

Use a subdomain for --domain: with a bare domain such as example.com, the derived console host would be example-admin.com, which you do not own. The two hosts must share a parent domain, so that one sign-in session works on both. To choose another console host, set POD_ADMIN_DOMAIN and POD_ADMIN_URL with synap config set.

DNSCopy Anchor Link

Create an A record (and AAAA if the server has IPv6) for both host names, pointing at the server, before you install. Check them from the server:

cd /opt/synap/deploy
sudo synap connectivity     # DNS and /health for the pod's domain

Automatic HTTPSCopy Anchor Link

Caddy obtains and renews certificates from Let's Encrypt for both host names. It needs:

• ports 80 and 443 (TCP) open to the internet, and 443/udp for HTTP/3;
• DNS already pointing at the server;
• a contact email (LETSENCRYPT_EMAIL, set from --email).

If a certificate is missing, check DNS first, then sudo synap logs caddy.

Exposing a pod through a tunnelCopy Anchor Link

A tunnel lets a pod with no public IP, or no open ports, be reached from the internet. Caddy still serves the pod; the tunnel connects to it from the inside.

At install time:

curl -fsSL https://github.com/synap-core/backend/releases/download/channel-stable/install.sh \
  | sudo bash -s -- --domain pod.example.com --edge tunnel --tunnel-token-file /root/cloudflare-token

On an installed pod:

cd /opt/synap/deploy
sudo synap tunnel enable cloudflare --token-file /root/cloudflare-token
sudo synap tunnel status
sudo synap tunnel disable

synap tunnel enable writes the token to .env (CLOUDFLARED_TUNNEL_TOKEN for Cloudflare) and starts the matching Compose profile. In the Cloudflare dashboard, route the tunnel's public host names to the pod. Prefer --token-file over --token, so the token does not end up in your shell history.

pangolin is also accepted as a provider. The shipped Pangolin profile is a placeholder: check that it points at your real Pangolin connector image before relying on it.

Another web server in front of the podCopy Anchor Link

If another reverse proxy owns ports 80 and 443 on the server (for example Traefik, as on an Eve-managed server), install with --edge traefik. SYNAP_EDGE=traefik is then pinned in .env, and updates do not try to bind Caddy to those ports. Your proxy must route both host names to the pod.