Власні домени застосунків

Availability

Custom-domain ownership verification implemented, but custom-domain traffic and certificate serving are not. Current service can store domain request, return DNS instructions, query public DNS, allow only verified names through planned Caddy tls-ask gate.

It does not yet add verified hostname to gateway, obtain certificate, route requests for that hostname. Do not move production traffic to this feature yet. verified status proves only configured DNS ownership check.

Verification workflow

Attach hostname to app slug.
Publish returned DNS records.
Ask service to verify against public resolvers.
Inspect returned status and any check error.
Keep using platform preview URL; verification does not activate custom hostname.

Subdomains use CNAME check against <slug>.apps.openfactory.tech. Apex names use generated TXT challenge plus presence of A record. Apex A record not checked against particular ingress address, so not route validation.

REST surface

Method	Path	Current result
`POST`	`/api/app-gateway/domains`	Stores pending domain and returns DNS instructions.
`GET`	`/api/app-gateway/domains?app_slug={slug}`	Lists domain records.
`GET`	`/api/app-gateway/domains/{domain}`	Gets one record.
`POST`	`/api/app-gateway/domains/{domain}/verify`	Performs immediate public-DNS check.
`DELETE`	`/api/app-gateway/domains/{domain}`	Removes stored record.
`GET`	`/api/app-gateway/tls-ask?domain={domain}`	Returns allow or deny for verified record; intended for future Caddy integration.

Example attach request:


POST /api/app-gateway/domains
Content-Type: application/json
 
{
  "app_slug": "my-app",
  "domain": "app.example.com"
}

Service rejects platform-owned zones, duplicate ownership, invalid hostnames, more than five domains per app.

What remains before activation

Production use requires all following completed and tested:

gateway configuration for each verified hostname;
decided public-ingress path that can terminate customer certificate;
certificate issuance, renewal, expiry inventory, alerting;
immediate and periodic reconciliation after DNS changes;
owner authorization on every list, read, verify, delete path; and
real-domain test covering DNS, TLS, routing, renewal, removal, rollback.

Until that evidence exists, treat domain API as DNS-verification preview only.