Routing and TLS

A Service can run privately without domains or tls. Add a domain to an environment when it should receive public traffic, then point DNS at that environment’s server:

.towbar/services/web.service.yml

id: web
name: Web
tls:
  mode: direct
environments:
  production:
    server: 192.0.2.10
    domains:
      primary: app.example.com

Register and prepare the server first. Towbar rejects a hostname already owned elsewhere in the workspace. Keep separate production and staging names rather than pointing both environments at the same hostname. For a Cloudflare DNS-validated certificate, select that mode in the Service manifest and configure the Cloudflare runtime integration in /etc/towbar/config.yml. A deployment requesting Cloudflare DNS TLS is rejected before queueing if that integration is absent. The target server’s Caddy DNS module is prepared when a workload needs it; this is not a server-wide TLS toggle. See Domains and TLS for direct validation, Cloudflare validation, DNS prerequisites, and failure handling. ingress policy and exact field shapes are in the Service JSON Schema.

Last modified on September 27, 2026

Servers

Repositories

Services

Datastores

Secrets

Deployments and access

Routing and TLS