Domains and HTTPS
Layup serves every app and the dashboard through Caddy, which gets a free Let's Encrypt certificate for each address. Plain HTTP requests to an HTTPS address are sent to HTTPS.
Your own domain
Under Server > Networking, set:
| Setting | What it is | Example |
|---|---|---|
| Dashboard address | Where you open Layup itself | deploy.example.com |
| Wildcard domain | The domain new app addresses are made under | apps.example.com |
| Let's Encrypt email | Where Let's Encrypt writes about expiring certificates | you@example.com |
Then point DNS at the server. One wildcard record covers every app:
Generate a host on a route makes names like shop-x7k2.apps.example.com. Any other host works too, such as shop.example.com, as long as its DNS points at the server.
A route's certificate shows Issuing certificate until it works. If it can't be issued after a few minutes, the route says why, usually that DNS doesn't point at the server yet. Layup keeps trying, so fixing DNS is enough.
Behind Cloudflare
Cloudflare's orange-cloud proxy works. Turn on Trust Cloudflare under Server > Networking, so apps, logs, rate limits and IP allowlists see the visitor's address instead of Cloudflare's. Set Cloudflare's SSL mode to Full (strict).
Behind another proxy or load balancer, add its addresses to Trusted proxies instead.
Your own certificate
Under Server > Certificates, upload a certificate and its private key. Every route whose host it covers uses it, and Let's Encrypt handles the rest. When an uploaded certificate expires, its hosts go back to Let's Encrypt. To renew, replace it with the new certificate; the saved key is kept if you don't paste one.
TCP ports
Databases and other non-HTTP services get a TCP route: a public port on the server that forwards to the service, such as port 5432 to Postgres. There's no certificate or host name; connect to the server's address and port. Ports 80 and 443, the dashboard's port, and ports other programs on the server use are refused.