Domains

The Domains page is the one place to see every web address your server answers on. Each project also has its own Domains & Routes tab (see Custom domains); this page shows the same domains for all projects at once, checks their DNS live, and tells you which certificates are healthy, which are about to renew and which need you.

You see the domains of every project you have access to. Adding, verifying and renewing needs write access to the project; removing a domain needs admin access to it (see Permissions).

The Domains tab

Summary tiles

Four tiles sit at the top. Each one is also a filter: click it to show only those rows, click it again to show everything.

Search and filters

Under the tiles:

• Search domains, projects or services matches the hostname, the project name or slug, and the service name.
• The Project picker narrows the list to one project (All projects by default).
• The Status picker offers All statuses, Needs attention, HTTPS active, Issuing, Failed or expired, Expiring soon and No certificate.
• When any certificates are due, a Renew {n} due button appears. It renews every due certificate in one go and reports "Renewed X of Y certificates.", followed by the reason for each one that failed.

Clear filters resets all three when nothing matches. The refresh button at the top right reloads the list.

Rows are sorted with problems first, then by project and hostname, with each project's primary domain first.

The table

On a wide screen the list is a table; on a phone each domain is a card with the same fields.

If the last verification or certificate attempt failed, a red line under the domain gives the reason in plain words, for example "Last attempt 5 minutes ago: ...".

What the internal target means

The internal target is the address the edge proxies to on the project's private network:

• a service route goes to the service's network alias (its name, or the custom alias set on the service) and the container port you chose, for example http://api:8080;
• a single-app route goes to the project's own alias (its slug) and port;
• an app running directly on the host (not in Docker) goes to 127.0.0.1 and its port.

If the port shown is not the one your app listens on, visitors get a 502. Fix it from the project's Domains & Routes tab with Edit domains or Edit route.

Live DNS check

When the page opens, Synq looks up every custom domain in public DNS (a few at a time) and compares the answer with the record it expects. You can re-run it for one domain with Check DNS in the row menu.

The lookup asks Google's public DNS-over-HTTPS resolver first, so it usually sees what the rest of the internet sees, not a cached answer on your laptop. If Google can't be reached it falls back to the server's own resolver, and a lookup that fails or times out also shows No record yet, so run Check DNS again before acting on it. It is only advice: on a Synq server, verification is decided by whether a certificate can be issued, not by this lookup.

Certificate states

The countdown turns amber inside the 14-day renewal window and red in the last 7 days.

Row actions

Open the ⋯ menu (Domain actions) at the end of a row. Only the actions that make sense for that domain are listed:

A spinner replaces the menu while an action runs on that row.

Add a domain with the wizard

Add domain (top right, and on the empty page) opens a three-step wizard: Route, DNS, HTTPS. It saves the domain exactly as the project's own Domains & Routes tab would, so you can use either.

The Certificates tab

The Certificates tab (/domains?tab=certificates) is about the certificates themselves.

How HTTPS works here

A short explainer card states the rules this server follows: every custom domain gets a free Let's Encrypt certificate without Cloudflare or a DNS provider account; Synq proves control with an HTTP-01 challenge, so the domain needs an A record pointing here and port 80 open; wildcard certificates use DNS-01, which needs a connected DNS provider. It also says whether a DNS provider is connected, with a Manage DNS providers link to Settings → Credentials.

Certificate list

One row per certificate that was issued or installed on this server (domains handled by your own proxy are left out). Each row shows the domain and the name the certificate covers, the state and issuer, the expiry, Auto-renew and Last check:

The row buttons are Renew certificate (or Issue certificate when it isn't active), Upload certificate for manual ones, and a recheck button.

Automatic renewal

The Automatic renewal card reports the SSL certificate renewal job: "Certificates renew automatically when fewer than 14 days remain.", the next run, and the result of the last run. Open renewal job goes to the job at /jobs/ssl:renew, where you can see its history, run it now or change its schedule. By default it runs once a day at 03:17 server time.

If the job is off, the card warns: "The renewal job is turned off. Certificates will expire unless you renew them by hand."

Certificate authority

The Certificate authority card shows what certbot uses when it requests certificates: Provider (Let's Encrypt, Let's Encrypt staging, ZeroSSL or a custom ACME server), Directory URL, Contact email, Staging mode, External account binding, Key type and Custom trust root.

Only the contact email can be changed here, and only by an instance administrator: press Change, enter an address and Save. It overrides SYNQ_ACME_EMAIL for new registrations and renewals; Use the environment value removes the override. The certificate authority sends expiry notices to this address.

Everything else comes from environment variables on the server. See Certificate authority settings.

Related