MidnightDocs

Domains and TLS#

Get a service reachable, and understand exactly what Midnight does and does not do about HTTPS.

Before you start#

  • A deployed service.
  • Traefik running, with its static file-provider configuration pointing at the Midnight dynamic directory.
  • Control of DNS for any hostname you intend to use publicly.

Generated domains#

With an active human session, domain commands act on the project, service and environment recorded in .midnight/project.json:

midnight domain list
midnight domain add
midnight domain get dom_...
midnight domain delete --expected-version 1 dom_...

The server owns the generated hostname, root path, target port, public HTTP intent, and disabled-TLS state. These are server-owned properties, not values you supply.

Delete requires the current version, so a stale view cannot remove a domain that has since changed.

What HTTPS actually requires#

Midnight includes a certificate issuance engine built on lego, with Cloudflare, Route 53 and manual DNS-01 challenge providers, a staging-first production acknowledgement gate, durable certificate-order state, and an opt-in domain lifecycle reconciler. The worker records certificate references and keeps routes fail-closed until durable TLS evidence exists.

Important

Installed and public HTTPS still requires your Traefik state path and external DNS and ingress proof. Issuance existing in the product does not by itself produce a working public HTTPS endpoint.

Two consequences:

  • Routes fail closed. A route without durable TLS evidence does not serve insecurely; it does not serve. That is the safe behaviour, and it means "not reachable yet" is the expected state until TLS evidence exists.
  • Staging first. Production issuance is gated behind an explicit acknowledgement, so you cannot burn production rate limits by accident.

Cloudflare DNS#

Cloudflare is the planned first delegated-DNS provider for custom-domain ownership, routing records, and ACME challenges.

Important

The general record connector is not implemented. Cloudflare works as a DNS-01 challenge provider for issuance; it does not yet manage your records for you.

Verify#

  1. midnight domain list shows the expected domain with its version.
  2. Traefik is serving the route.
  3. The hostname resolves to the host from outside your network.
  4. An HTTPS request succeeds, or fails closed rather than serving plaintext.

If it does not work#

Symptom Check Recovery
Route returns nothing Whether durable TLS evidence exists Routes fail closed by design; complete issuance
Traefik never picks up the route Traefik's static file-provider path It must point at the Midnight dynamic directory
Issuance never completes The DNS-01 challenge provider configuration Manual DNS-01 is available when a provider is not
Production issuance is refused The staging-first acknowledgement gate Acknowledge deliberately after staging succeeds
Cloudflare records are not updated The record connector is not implemented Manage records yourself
Domain delete is refused The expected version Re-read with domain get and retry