Domains and HTTPS
Serve your apps on your own subdomains and custom domains.
Your subdomains #
You own every name ending in -<you>.user.cd.pico.sh, and
<you>.user.cd.pico.sh. As alice, web-alice.user.cd.pico.sh and
alice.user.cd.pico.sh are yours. They serve HTTPS with picd's wildcard
certificate, so there's nothing to set up.
Route a name to a service with Traefik labels. Routes for hosts you don't own aren't served.
Custom domains #
Point the domain at picd, and show picd it's yours with a TXT record naming your username:
1app.example.org. CNAME alice.user.cd.pico.sh.
2_picd.app.example.org. TXT "alice"
At a zone's apex, where CNAMEs aren't allowed, use an A record with the
address alice.user.cd.pico.sh resolves to. Then:
1ssh cd.pico.sh domains add app.example.org
Your apps can now route app.example.org, and picd requests a certificate
for it. Without the TXT record, the command tells you what to add.
ssh pico.sh dns-check app.example.org shows what both records hold.
1ssh cd.pico.sh domains
2ssh cd.pico.sh domains rm app.example.org
A domain belongs to one user at a time. If another user holds it, adding it
moves it to you, since its DNS now names you, and it stops routing to them.
Names under user.cd.pico.sh can't be added; they already belong to users
through their subdomains.