Routing and TLS

An app can run privately without domains or tls. Add a domain to an environment when it should receive public traffic, then point DNS at that environment’s server:

.towbar/apps/web.app.yml

id: web
name: Web
tls:
  mode: direct
environments:
  production:
    server: 192.0.2.10
    domains:
      primary: app.example.com

Register and prepare the server first. Towbar rejects a hostname already owned elsewhere in the workspace. Keep separate production and staging names rather than pointing both environments at the same hostname. For a Cloudflare DNS-validated certificate, select that mode in the app manifest and configure the Cloudflare runtime integration in /etc/towbar/towbar.yml. A deployment requesting Cloudflare DNS TLS is rejected before queueing if that integration is absent. The target server’s Caddy DNS module is prepared when a workload needs it; this is not a server-wide TLS toggle. See Domains and TLS for direct validation, Cloudflare validation, DNS prerequisites, and failure handling. ingress policy and exact field shapes are in the app JSON Schema.

Last modified on September 26, 2026

Repositories

Servers

Applications

Resources

Secrets

Deployments and access

Routing and TLS