Custom domains
Every app or function can answer at your own domain as well as its address on trustpage.ir; we obtain its HTTPS certificate and renew it before it runs out.
Add a domain#
In the dashboard: project settings → Domains → Add domain. Or from the CLI or the API. Both a subdomain (shop.example.ir) and the domain itself (example.ir) work. For a domain or its www name you can add both at once, one redirecting to the other (we suggest www to the domain).
cloudhost domains add shop.example.ir --project my-site
cloudhost domains add example.ir --project my-site --www apex # www.example.ir redirects to example.ir
cloudhost domains verify shop.example.ir
cloudhost domains lsThe DNS records#
Adding a domain answers with exactly the records to set at your DNS provider (the dashboard has copy buttons). Names are relative to the registered domain; @ is the domain itself.
| Domain | Record | Value |
|---|---|---|
a subdomain (shop.example.ir) | CNAME shop | cname.trustpage.ir |
the domain itself (example.ir) | A @, one per address | the gateway addresses in the answer |
| always, once per registered domain | TXT _cloudhost-verify | cloudhost-verify=<token> |
The TXT record shows the domain is yours. One record on the registered domain covers every name under it for your team. It is always asked for, not only when someone else wants the name: a CNAME or A record left behind after a project is deleted must never let another team take the name. Once ownership is proven it stays proven, and you may remove the TXT record.
- If your provider can only set A records for a subdomain, the gateway addresses work too.
- An
AAAArecord pointing anywhere else is reported as wrong: visitors and the certificate check over IPv6 would go there. - Public suffixes (
co.ir), wildcards (*.example.ir), IP addresses and the platform's own addresses are refused. - Do not put a CDN or proxy in front: the certificate check must reach us directly.
States#
| State | Means |
|---|---|
pending | the records are not there yet. |
misconfigured | a record is there and wrong; the message says which and what it must be. |
verifying | everything is right and the certificate is on its way (seconds). |
valid | served over HTTPS; plain HTTP redirects to HTTPS. |
error | the certificate failed, or another team proved ownership of the name; the reason is given and we try again. |
Pending domains are checked every few seconds at first, then less often; Refresh in the dashboard or cloudhost domains verify checks now. Certificates are renewed 45 days before they run out; if a renewal fails, the current certificate stays, we try again, and we tell you if 21 days are left. We use two certificate authorities; if the domain has CAA records, they must allow both.
Redirects and branch domains#
A domain can redirect to another domain of the same project instead of serving (308 by default; 301, 302 and 307 too). The path and query are kept. A domain can also serve a git branch's preview instead of production, for example staging.example.ir for the branch staging.
cloudhost domains add old-shop.example.ir --project my-site --redirect-to shop.example.ir --redirect-status 301
cloudhost domains add staging.example.ir --project my-site --branch stagingLimits#
| Plan | Domains per project | Adds per hour |
|---|---|---|
| Hobby | 4 | 10 |
| Pro | 50 | 30 |
| Enterprise | by agreement | 100 |
AI assistants#
The MCP server has the tools list_domains, add_domain, verify_domain, update_domain and remove_domain (MCP).