Domain and HTTPS

Before your instance faces the internet, give it a domain and HTTPS. The installer can do this for you, or you can put Railhook behind a reverse proxy you already run.

Built-in HTTPS

1. Point the domain at the server

   Create an A record for the domain with the server’s public IP. Ports 80 and 443 must be free and open to the internet.

2. Install with the domain

   curl -fsSL https://railhook.io/install.sh | bash -s -- --domain hooks.example.com --email [email protected]

What --domain changes

Setting	Value
TLS terminator	Caddy runs on 80 and 443, and obtains and renews a Let’s Encrypt certificate itself
Dashboard nginx	Moves to 127.0.0.1:8080, behind Caddy
APP_ENV	production, so the platform refuses to start on unsafe configuration
APP_BASE_URL, CORS_ALLOWED_ORIGINS	https://<your domain>
Source ingress and CLI tunnel URLs	Follow APP_BASE_URL, so providers get https://<your domain>/ingress/…
DB_SSL_MODE	require
LOG_LEVEL	WARN
WEBHOOK_TRUSTED_PROXIES	172.16.0.0/12, so real client IPs reach the audit log

Caution

Certificates live in the caddy_data volume. If you lose it, the certificate is issued again on the next start, and Let’s Encrypt rate-limits that.

Your own proxy

1. Install with the domain, behind your proxy

   curl -fsSL https://railhook.io/install.sh | bash -s -- --domain hooks.example.com --behind-proxy

   You get every setting from the built-in HTTPS table except the TLS terminator. No Caddy runs, and your proxy keeps the certificate. The dashboard’s nginx listens on 127.0.0.1:8080. Use --port to pick another loopback port.

2. Proxy everything to 127.0.0.1:8080

   Send every path for the domain to http://127.0.0.1:8080. nginx inside already routes the dashboard, /api/, /ingress/, /hook/, /tunnel/ and /ws/tunnel. The /ws/tunnel path is a WebSocket held open for a whole CLI session, so pass the upgrade headers and use a long read timeout (the built-in Caddy uses one hour).

In production mode

With APP_ENV=production the API refuses to start, rather than run, when:

• a secret still holds a placeholder or a shipped default,
• WEBHOOK_ALLOW_PRIVATE_IPS=true,
• SWAGGER_ENABLED=true,
• CORS_ALLOWED_ORIGINS still contains localhost.

./railhook doctor checks these ahead of time. It also warns if APP_BASE_URL still points at localhost, or if EMAIL_ENABLED is off: with email off, accounts are created already verified and nobody can be invited.

Next steps

ConfigurationEmail, secrets and the rest of the settings.

Upgrade and backupKeep the instance current and recoverable.