Custom App Domains

Verfügbarkeit

Custom-domain ownership verification ist implementiert, custom-domain traffic und certificate serving aber nicht. Current service kann domain request store, DNS instructions return, public DNS query und nur verified names through planned Caddy tls-ask gate allow.

Adds verified hostname noch nicht to gateway, obtains certificate nicht, routes requests für hostname nicht. Move production traffic to this feature noch nicht. verified status proves only configured DNS ownership check.

Verification workflow

Hostname an app slug attach.
Returned DNS records publish.
Service ask to verify against public resolvers.
Returned status und any check error inspizieren.
Keep using platform preview URL; verification activates custom hostname nicht.

Subdomains use CNAME check against <slug>.apps.openfactory.tech. Apex names use generated TXT challenge plus presence of A record. Apex A record not checked against particular ingress address, also keine route validation.

REST surface

Method	Path	Current result
`POST`	`/api/app-gateway/domains`	Stores pending domain und returns DNS instructions.
`GET`	`/api/app-gateway/domains?app_slug={slug}`	Lists domain records.
`GET`	`/api/app-gateway/domains/{domain}`	Gets one record.
`POST`	`/api/app-gateway/domains/{domain}/verify`	Performs immediate public-DNS check.
`DELETE`	`/api/app-gateway/domains/{domain}`	Removes stored record.
`GET`	`/api/app-gateway/tls-ask?domain={domain}`	Returns allow or deny for verified record; intended for future Caddy integration.

Example attach request:


POST /api/app-gateway/domains
Content-Type: application/json
 
{
  "app_slug": "my-app",
  "domain": "app.example.com"
}

Service rejects platform-owned zones, duplicate ownership, invalid hostnames und more than five domains per app.

What remains before activation

Production use requires all completed und tested:

gateway configuration for each verified hostname;
decided public-ingress path terminating customer certificate;
certificate issuance, renewal, expiry inventory und alerting;
immediate und periodic reconciliation after DNS changes;
owner authorization on every list, read, verify und delete path; und
real-domain test covering DNS, TLS, routing, renewal, removal und rollback.

Until evidence exists, treat domain API as DNS-verification preview only.