Domains and TLS#
Get a service reachable, and understand exactly what Midnight does and does not do about HTTPS.
Before you start#
- A deployed service.
- Traefik running, with its static file-provider configuration pointing at the Midnight dynamic directory.
- Control of DNS for any hostname you intend to use publicly.
Generated domains#
With an active human session, domain commands act on the project, service and
environment recorded in .midnight/project.json:
midnight domain list
midnight domain add
midnight domain get dom_...
midnight domain delete --expected-version 1 dom_...
The server owns the generated hostname, root path, target port, public HTTP intent, and disabled-TLS state. These are server-owned properties, not values you supply.
Delete requires the current version, so a stale view cannot remove a domain that has since changed.
What HTTPS actually requires#
Midnight includes a certificate issuance engine built on lego, with Cloudflare, Route 53 and manual DNS-01 challenge providers, a staging-first production acknowledgement gate, durable certificate-order state, and an opt-in domain lifecycle reconciler. The worker records certificate references and keeps routes fail-closed until durable TLS evidence exists.
Installed and public HTTPS still requires your Traefik state path and external DNS and ingress proof. Issuance existing in the product does not by itself produce a working public HTTPS endpoint.
Two consequences:
- Routes fail closed. A route without durable TLS evidence does not serve insecurely; it does not serve. That is the safe behaviour, and it means "not reachable yet" is the expected state until TLS evidence exists.
- Staging first. Production issuance is gated behind an explicit acknowledgement, so you cannot burn production rate limits by accident.
Cloudflare DNS#
Cloudflare is the planned first delegated-DNS provider for custom-domain ownership, routing records, and ACME challenges.
The general record connector is not implemented. Cloudflare works as a DNS-01 challenge provider for issuance; it does not yet manage your records for you.
Verify#
midnight domain listshows the expected domain with its version.- Traefik is serving the route.
- The hostname resolves to the host from outside your network.
- An HTTPS request succeeds, or fails closed rather than serving plaintext.
If it does not work#
| Symptom | Check | Recovery |
|---|---|---|
| Route returns nothing | Whether durable TLS evidence exists | Routes fail closed by design; complete issuance |
| Traefik never picks up the route | Traefik's static file-provider path | It must point at the Midnight dynamic directory |
| Issuance never completes | The DNS-01 challenge provider configuration | Manual DNS-01 is available when a provider is not |
| Production issuance is refused | The staging-first acknowledgement gate | Acknowledge deliberately after staging succeeds |
| Cloudflare records are not updated | The record connector is not implemented | Manage records yourself |
| Domain delete is refused | The expected version | Re-read with domain get and retry |