Domains for the panel and your apps

The DNS records a Synq install needs, how to serve the panel on your own domain at install or later with synq panel-domain, what happens when the panel moves to another host, domains for your apps, and the Let's Encrypt contact email.

A Synq install uses domains in two places:

the panel: the dashboard and its API, for example https://panel.example.com;
your apps: each app you deploy can have custom domains, and free subdomains of an apps domain.

Every domain is yours. Synq serves them from your server through its edge on ports 80 and 443, with free Let's Encrypt certificates it requests and renews itself. Nothing points at Synquic's DNS.

DNS records

Create the records at your DNS provider, pointing at your server's public IP:

Type	Name	For
`A`	`panel.example.com`	The panel
`A` (or `CNAME`)	`shop.example.com`	A custom domain of one of your apps
`A`	`*.apps.example.com`	Free subdomains for your apps (`<app>.apps.example.com`), if you set an apps domain

Let's Encrypt checks each name over HTTP before it issues a certificate, so the records must resolve and ports 80 and 443 must be open. A wildcard record covers exactly one level: shop.apps.example.com matches *.apps.example.com, while a.b.apps.example.com does not.

The panel's domain

At install

Pass --domain and --email to the installer:

curl -sSL https://synquic.tech/install.sh | sh -s -- --key <KEY> \
  --domain panel.example.com --email you@example.com

The panel comes up on https://panel.example.com behind Synq's edge, with its own ports (3001 and 4000) kept off the public network. If the record doesn't point at the server yet, the installer says so and Synq keeps retrying the certificate in the background. See Install on a new server.

After the install

Installed without a domain (the panel is on http://<server IP>:3001), or want the panel on another host? Create the A record for the new host, then run on the server:

sudo synq panel-domain panel.example.com --email you@example.com

It checks DNS

If the host doesn't resolve to this server, it stops and names the record to create. Nothing is changed.

It gets the certificate first

The host is added to Synq's edge and its Let's Encrypt certificate is requested while the panel keeps serving its current address. If the certificate can't be issued (DNS not propagated yet, port 80 blocked), the host is removed again and the command stops with the reason: the panel stays where it was.

It moves the panel

Synq restarts with the panel on https://panel.example.com and its own ports back on the loopback interface. Your deployed apps keep running. When Synq starts, the new host becomes the panel's address and the old one is released: nothing answers on http://<server IP>:3001 or the old domain any more.

It checks the result

It fetches the new address through the server's own edge. If Synq doesn't come back, or the new address doesn't answer over HTTPS with a trusted certificate, it restores the previous settings and the panel returns to its old address.

Option	What it does
`--email EMAIL`	The Let's Encrypt contact for certificate notices. Needed the first time; after that the install's contact is used.
`--skip-dns-check`	Don't compare the host's DNS record with the server's IP. Use it when a proxy such as Cloudflare sits in front of the server, so the host resolves to the proxy.

sudo synq panel-domain with no host shows the panel's current address. Running it again for the host the panel is already on changes nothing, so it is safe to repeat. It doesn't touch the admin account or anyone's password.

Move the panel to another host

Moving the panel from one domain to another is the same command with the new host. Keep the old host's DNS record until the move has finished.

After a move:

Everyone signs in again at the new address: browser sessions belong to an address.
Close port 3001 if you opened it for an install without a domain.
CLI. Point your context at the new host, for example synq context add default --api-url https://panel.example.com --dashboard-url https://panel.example.com.
AI agents (MCP). OAuth-connected clients were authorized for the old endpoint and are refused at the new one: remove them from the client and add https://<new host>/api/mcp again (see MCP). Clients that use a static token only need the new URL.
Git webhooks and GitHub Apps. Change the webhook, callback and setup URLs to the new host at the provider.
Bookmarks and scripts that call the API.

Limits

The host must be a public domain name, not an IP address or a local name (.local, .internal, .test).
Synq never takes a host that one of your projects already uses. Remove it from that project first.
The panel is locked while its license isn't active, and can't be moved until it is.
Moving the panel to another machine is a different task: see panel backups and moving your setup to another install.

Your apps' domains

Custom domains. Add your own domain to any app: point its DNS record at the server, add it to the app, and Synq verifies it and issues the certificate. See Custom domains.
An apps domain. With a wildcard record *.apps.example.com, apps get free subdomains such as shop.apps.example.com without a DNS change each time. Set the apps domain at install with --apps-domain apps.example.com, or later in the panel's Settings.
Without a domain. On an install that only has an IP address, apps get addresses such as shop.203-0-113-10.sslip.io by default, which work without any DNS setup.

Turn the edge on or off

Synq's edge is the container that serves the panel and your apps on ports 80 and 443. A server installed with --edge off runs without it and leaves those ports to another web server (see Install next to another web server). While the edge is off, domains and certificates wait, and the panel says so.

Turn it on

sudo synq edge on --migrate    # import the other web server's sites, then take ports 80 and 443
sudo synq edge on --takeover   # stop the other web server; its sites stop being served

Without a flag, synq edge on asks what to do if another web server holds the ports, and leaves the edge off when there is no terminal to ask on. It fetches the edge's image first, so nothing is stopped during the download, and records what it stops in /var/lib/synq/edge-takeover.json before stopping it. If the edge doesn't come up, the previous web server is restarted and the server stays edge-off. When the edge is already on and serving, it changes nothing. synq up --edge migrate (or --edge takeover) does the same.

With the edge on, synq edge on publishes the routes of the apps deployed while it was off (it names any it couldn't; redeploy those). The panel's domain gets its route and certificate as the API restarts, and app domains are verified by the next automatic domain check (every few minutes) or when you press Verify.

Hand the ports back

sudo synq edge restore

After a takeover, synq edge restore stops Synq's edge, then restarts and re-enables what the takeover stopped (systemd units, containers or processes), as recorded in /var/lib/synq/edge-takeover-restore.json. Certificate files a migration replaced under /etc/letsencrypt/live/ are put back as they were; when none were recorded, it says what to check by hand. It then turns the edge off (SYNQ_EDGE=off in /root/.synq/compose/.env), so later synq up and synq update keep it off, and prints each step it took. Running it again finds nothing to restore and changes nothing. A takeover that finished before Synq kept this record can't be restored automatically; the command prints the steps to do it by hand.

To turn the edge off when there is no takeover to undo, run sudo synq up --edge off.

Let's Encrypt contact email

Let's Encrypt sends certificate expiry warnings to a contact email. You can change it in the panel without touching the server.

Open the certificate authority card

Go to Domains and choose the Certificates tab (or Settings, then Certificates). The Certificate authority card lists the provider, directory URL, Contact email, external account binding, key type and staging mode.

Change the email

Press Change next to the contact email, type the address and press Save. Only instance administrators see Change.

The line under the email says where it comes from:

Source	Meaning
Set here	The address you saved in the panel. It wins over the environment.
From SYNQ_ACME_EMAIL	The server's `SYNQ_ACME_EMAIL` setting (the installer's `--email`).
Not set	No address: certificates are still issued, but the CA can't send expiry notices.

To go back to the server's value, press Change, then Use the environment value. The address is used for new certificate registrations and renewals; certificates that already exist keep working. Every change is recorded in the audit log as Certificate contact email changed.

Check it once after installing

After installing, open this card. If the contact email reads Not set, save your address here so expiry notices reach you.

The other certificate authority values (SYNQ_ACME_DIRECTORY_URL, SYNQ_ACME_EAB_KID, SYNQ_ACME_EAB_HMAC_KEY, SYNQ_ACME_KEY_TYPE, SYNQ_ACME_CA_BUNDLE and the other SYNQ_ACME_* keys) are read-only in the panel. Add them to /root/.synq/compose/.env on the server, then run sudo synq up so the API starts with them. They are kept across updates.

From the API: GET /api/domains/acme reads the settings and PUT /api/domains/acme/email sets the email (null or "" clears it). See the Domains API.