Domains and TLS

Configure DNS

1. Set the project domain

   Open Projects, select the project, choose edit, and enter the full hostname, such as app.example.com. Save the change.

2. Point visitors to the app

   On the project page, find DNS setup and copy the server IP. At your DNS provider, add an A record for that exact hostname pointing to the shown IP. If you use Cloudflare, its proxy can be on; public lookups will then show Cloudflare IPs instead of the server IP.

3. Wait for propagation

   Check the exact hostname you entered. An apex domain and its www subdomain need separate DNS records and project routing. DNS changes may take time to reach every resolver.

Choose a TLS path

A domain under the DeployGrove platform domain can use the platform certificate path. A domain you own needs one of the following paths.

Preferred: add a CNAME for SSL

On the project page, select Check domain & TLS. When it offers Recommended: delegate the challenge, create this record in the DNS zone for your custom domain:

1. Type: CNAME.
2. Name: _acme-challenge. followed by your exact project hostname. For app.example.com, use _acme-challenge.app.example.com; your DNS provider may ask for only the name relative to the zone.
3. Target: copy the exact target shown by Check domain & TLS. It is unique to your hostname; do not point this record at your app or invent a target.
4. Proxy: DNS only (grey cloud) in Cloudflare. Leave TTL on Auto.

Save the CNAME, wait for it to resolve, and run Check domain & TLS again. Then deploy to request the certificate and open the hostname over HTTPS. Keep the CNAME in place for future certificate checks. No API token for your DNS zone is needed. This SSL CNAME is separate from the visitor-facing A record, which may be proxied.

Alternative: project Cloudflare token

For a domain in your Cloudflare zone, create a token scoped to that zone with Zone:DNS:Edit. Open project edit, expand TLS Certificate (per-project), and paste it into Cloudflare DNS-01 API token. Save and deploy to request a certificate.

Alternative: upload a certificate

Expand TLS Certificate (per-project), paste a certificate covering the exact hostname and its matching private key, then save. A Cloudflare Origin CA certificate works for traffic through Cloudflare; set the zone to Full (strict). For direct visitors, use a certificate trusted by their browsers.

Verify the domain

Open the project and select Check domain & TLS. It checks public DNS and whether a certificate path exists; a TLS checkmark does not mean the certificate has already been issued. The same check writes warnings to deployment logs without blocking a release.

After DNS and any challenge CNAME resolve, deploy the project and open the exact hostname over HTTPS. When the Cloudflare proxy is on, the DNS check may show Cloudflare IPs and a warning rather than the server IP; that is expected. Confirm the live page and certificate in your browser.

What success looks like

Troubleshooting

No DNS answer

Confirm the A record exists for the exact hostname and uses the server IP from DNS setup. Check that you edited the authoritative DNS zone, then allow caches to expire.

Cloudflare IPs appear in the check

Cloudflare returns its own IPs for a proxied A record. This warning is expected if the site opens through Cloudflare. If it does not, confirm the record still points to the project server in Cloudflare DNS.

No certificate path is available

Run Check domain & TLS and add the exact delegation CNAME it offers, set to DNS only. If delegation is unavailable, use a project Cloudflare token or upload a certificate. Include the readiness result in a support request, but no token or key.

The certificate is missing or mismatched

Confirm the challenge CNAME resolves, then deploy to request the certificate. For an uploaded certificate, confirm it covers the exact hostname and matches its private key. With a Cloudflare Origin CA certificate, use Full (strict) and keep the visitor-facing A record proxied.