Domains and certificates

Domain publication is coupled to a deployment because the final routing depends on both an application and a target server. The Domains & DNS page stores Cloudflare credentials and hostname declarations, but creating a domain leaves its DNS status pending and certificate status empty. No DNS record is written by that save operation. When a project deployment selects the domain, the runner points its A record at the selected server, issues and installs a Cloudflare Origin CA certificate, writes the Nginx virtual host and verifies the local application. This sequence keeps routing changes in the same tracked run as the container release.

Verify the Cloudflare credential first

Select Add Token and enter a label plus a Cloudflare API token. Deploy Bridge asks Cloudflare to verify that the token is active and lists the zones it can access before saving it in encrypted form. Rejected or inactive tokens are not stored as usable credentials. The server error states that the integration needs Zone:Read, DNS:Edit and SSL and Certificates:Edit capabilities. The console later displays a token hint, verification status and zone count rather than the token itself. Zone listing refreshes the credential status and records a Cloudflare error when access no longer works.

Declare a hostname inside the selected zone

Select Add Domain, choose a valid credential and then select a returned zone. Enter the complete hostname, such as an apex or subdomain, in lower case. The API resolves the zone name from Cloudflare where possible and refuses a hostname that is neither the zone itself nor below it. A hostname already configured for the same team is also refused. The domain allowance is consumed when this record is created. Although the data model can associate project and server identifiers, the current console creates an unbound declaration and binds it operationally when the hostname is selected in the project's Deploy dialog.

Publish the record during deployment

During the DNS step, Deploy Bridge upserts an A record for the hostname with the selected server's saved host address and the domain's proxy setting. The current domain form does not expose the proxy toggle, so its submitted default is proxied. The returned Cloudflare record identifier is saved and the domain status becomes active. This is not a DNS propagation guarantee. It records that Cloudflare accepted the record operation. If the credential was deleted after the domain was declared, deployment stops because the runner no longer has a token with which to perform DNS or certificate work.

Keep the private key on the server

The certificate step creates a new RSA private key and certificate signing request on the target server. Only the signing request is sent to Cloudflare. The request names the single bound hostname rather than adding a wildcard for the whole zone. Deploy Bridge writes the returned Origin CA certificate beneath /etc/ssl/deploy-bridge, restricts key and certificate permissions, removes the temporary signing request and asks Cloudflare to use Full (strict) mode with Always Use HTTPS. The domain record stores the installed status and certificate expiry when Cloudflare provides a valid date.

Validate Nginx before reloading it

The saved Nginx blueprint substitutes the selected hostname and the project's stable loopback host port. Deploy Bridge writes the result into /etc/nginx/conf.d, runs nginx -t and reloads Nginx only after that configuration test succeeds. The final deployment verification requests the application directly on 127.0.0.1 and its assigned port, separating an application-listening failure from the public Cloudflare route. A successful run reports the HTTPS URL and the console offers Open App. When no domain is selected, DNS, certificate and proxy steps are explicitly skipped and no public URL is asserted.

Removal does not reverse remote DNS

Deleting a domain removes the Deploy Bridge record, including the link used for later deployments. The console states that this does not delete the DNS record in Cloudflare. Likewise, removing a Cloudflare credential removes the stored integration token but is not documented as removing records or certificate files already created. Retire a hostname in the correct order: account for active traffic, alter or remove the external DNS record in Cloudflare where appropriate, handle Nginx and certificate material on the server, then remove the Deploy Bridge declaration. The product's delete action should not be treated as a complete DNS decommissioning workflow.