Custom app domains

Availability

Custom-domain ownership verification is implemented, but custom-domain traffic and certificate serving are not. The current service can store a domain request, return DNS instructions, query public DNS, and allow only verified names through the planned Caddy tls-ask gate.

It does not yet add a verified hostname to the gateway, obtain a certificate, or route requests for that hostname. Do not move production traffic to this feature yet. A verified status proves only the configured DNS ownership check.

Verification workflow

Attach a hostname to an app slug.
Publish the returned DNS records.
Ask the service to verify against public resolvers.
Inspect the returned status and any check error.
Keep using the platform preview URL; verification does not activate the custom hostname.

Subdomains use a CNAME check against <slug>.apps.openfactory.tech. Apex names use a generated TXT challenge plus the presence of an A record. An apex A record is not checked against a particular ingress address, so it is not route validation.

REST surface

Method	Path	Current result
`POST`	`/api/app-gateway/domains`	Stores a pending domain and returns DNS instructions.
`GET`	`/api/app-gateway/domains?app_slug={slug}`	Lists domain records.
`GET`	`/api/app-gateway/domains/{domain}`	Gets one record.
`POST`	`/api/app-gateway/domains/{domain}/verify`	Performs an immediate public-DNS check.
`DELETE`	`/api/app-gateway/domains/{domain}`	Removes the stored record.
`GET`	`/api/app-gateway/tls-ask?domain={domain}`	Returns allow or deny for a verified record; intended for the future Caddy integration.

Example attach request:


POST /api/app-gateway/domains
Content-Type: application/json
 
{
  "app_slug": "my-app",
  "domain": "app.example.com"
}

The service rejects platform-owned zones, duplicate ownership, invalid hostnames, and more than five domains per app.

What remains before activation

Production use requires all of these to be completed and tested:

gateway configuration for each verified hostname;
a decided public-ingress path that can terminate the customer’s certificate;
certificate issuance, renewal, expiry inventory, and alerting;
immediate and periodic reconciliation after DNS changes;
owner authorization on every list, read, verify, and delete path; and
a real-domain test covering DNS, TLS, routing, renewal, removal, and rollback.

Until that evidence exists, treat the domain API as a DNS-verification preview only.