Skip to content

TLS and redirects

Certificates

  • ACME: choose Let's Encrypt, ZeroSSL, Buypass or Google. Validation is HTTP-01 through the edge, so DNS must already point at us. Renewal runs daily when less than 30 days remain. Status, expiry and the last error are shown per hostname.
  • Own certificate: upload certificate and key; you handle renewal.
  • Each alias has its own certificate settings.

HTTPS redirect

https_redirect sends port 80 to 443 with a 301.

Redirect rules

Redirects per service with path, target, match_type (exact or prefix), redirect_type (prefix keeps the rest of the path) and optionally bind_to for a specific alias, for example apex to www:

- path: /
  target: https://www.example.com
  match_type: prefix
  redirect_type: prefix
  bind_to: example.com

Write the target without a trailing slash when redirect_type is prefix, otherwise the result has a double slash. append_trailing_slash adds / to directory-style paths.