Your own domain

Put an app on a domain you own, like app.example.com, through your own free Cloudflare account. Its Tailscale address keeps working too.

Connect Cloudflare (once per computer)

$ secretbase cloudflare connect
Connect your own Cloudflare account (free). If you have none, make one first at https://dash.cloudflare.com/sign-up
1. Open this link while signed in to Cloudflare:
   <link>
2. Check that the key lists Zone → Zone → Edit, Zone → DNS → Edit and Account → Cloudflare Tunnel → Edit (add any
   that is missing). Press "Continue to summary", then "Create Token", and copy the key it shows.
3. Paste the key here and press Enter (it isn't shown while you type):
…

The link opens Cloudflare's key form already filled in. Once the key is pasted, it says "Cloudflare is connected." The first time, it downloads Cloudflare's connector (about 40 MB).

Add the domain

In the app's folder:

$ secretbase domain app.example.com
app.example.com is saved for my-app. Connect your Cloudflare account once to put it online: secretbase cloudflare connect
$ secretbase domain list
app.example.com is saved. Connect Cloudflare to put it online: secretbase cloudflare connect

With Cloudflare connected, the app goes online on the domain by itself. secretbase domain list shows how it is going.

An app can have several own domains: run secretbase domain <name> again with another name and it is added beside the others, which keep answering. The first one that is live is the address the app shows. If Secretbase can't check a live name for a while (Cloudflare is busy, or your key lost that domain), the name keeps answering and shows why with the fix for the key; Secretbase tries again by itself.

To take a domain off an app: secretbase domain remove my-app app.example.com (it asks first; --yes skips the question). Its other domains keep answering, and it says the address the app keeps.

On the dashboard: the app's Settings, Your own domain: type the name, click Use this domain, and the page walks you through the Cloudflare key the first time. Add another domain adds one more, and each domain has its own Remove button.

A domain bought elsewhere

The domain's nameservers must be on Cloudflare. For a domain bought somewhere else, the dashboard shows "One change left. Where you bought example.com, set its nameservers to:" and the names. Set them there; if DNSSEC is on there, turn it off first. The page updates by itself once the change is seen: minutes, sometimes a few hours.

If you turned DNSSEC off, turn it back on once the domain is active in Cloudflare:

After this change Cloudflare answers for all of the domain's DNS. If the domain has email, check in Cloudflare that its MX and TXT records were copied before you change the nameservers.

Only on your domain

Once the domain is live, the app can stop answering at its Tailscale address:

$ secretbase tailscale off my-app

secretbase tailscale on my-app turns it back on (the address may differ from before).

Good to know

• Visitors connect to Cloudflare, which decrypts the traffic and forwards it to this computer through an encrypted tunnel. Cloudflare can see what your visitors send.
• Cloudflare's free plan doesn't allow serving video or mostly large files, or taking card numbers directly on your site. Use a hosted checkout for payments.

If something goes wrong

• "app.example.com already has a record Secretbase didn't create": approve replacing it with secretbase domain approve app.example.com on the computer, or click Move it to this computer on the dashboard.
• "app.example.com is already used by another app on this computer.": remove it there first.
• "isn't a domain name": type only the name, with no https://, slashes or port.