Domain and HTTPS

Give an internet-facing instance a domain and HTTPS, either through the installer or behind a reverse proxy you already run.

Built-in HTTPS

1. Point the domain at the server

   Create an A record for the domain with the server’s public IP. Ports 80 and 443 must be free and open to the internet.

2. Install with the domain

   curl -fsSL https://railhook.io/install.sh | bash -s -- --domain hooks.example.com --email ops@example.com

What --domain changes

Setting	Value
TLS terminator	Caddy runs on 80 and 443, and obtains and renews a Let’s Encrypt certificate itself
Dashboard nginx	Moves to 127.0.0.1:8080, behind Caddy
APP_ENV	production, so the platform refuses to start on unsafe configuration
APP_BASE_URL, CORS_ALLOWED_ORIGINS	https://<your domain>
Source ingress and CLI tunnel URLs	Follow APP_BASE_URL, so providers get https://<your domain>/ingress/…
LOG_LEVEL	WARN
WEBHOOK_TRUSTED_PROXIES	172.16.0.0/12, so real client IPs reach the audit log and the per-IP rate limits. Behind a CDN such as Cloudflare, add the CDN’s published address ranges too, or every visitor through one edge is counted as that edge

Caution

Certificates live in the caddy_data volume. If you lose it, the certificate is issued again on the next start, and Let’s Encrypt rate-limits that.

Your own proxy

1. Install with the domain, behind your proxy

   curl -fsSL https://railhook.io/install.sh | bash -s -- --domain hooks.example.com --behind-proxy

   Every setting from the built-in HTTPS table applies except the TLS terminator: no Caddy runs and your proxy keeps the certificate. The dashboard’s nginx listens on 127.0.0.1:8080 (change it with --port).

2. Proxy everything to 127.0.0.1:8080

   Send every path for the domain to http://127.0.0.1:8080. nginx inside already routes the dashboard, /api/, /ingress/, /hook/, /tunnel/ and /ws/tunnel. The /ws/tunnel path is a WebSocket held open for a whole CLI session, so pass the upgrade headers and use a long read timeout (the built-in Caddy uses one hour).

In production mode

With APP_ENV=production the API refuses to start when:

• a secret still holds a placeholder or a shipped default,
• WEBHOOK_ALLOW_PRIVATE_IPS=true,
• SWAGGER_ENABLED=true,
• CORS_ALLOWED_ORIGINS still contains localhost.

./railhook doctor checks these ahead of time. It also warns if APP_BASE_URL still points at localhost, or if EMAIL_ENABLED is off: with email off, accounts are created already verified and nobody can be invited.