Domain and HTTPS

Serve your instance on your own domain with an automatic HTTPS certificate.

Until you set a domain, the app listens only on the server itself, at 127.0.0.1:3000. Without HTTPS, sign-in cookies are not marked secure, so the app is not exposed to the internet. You reach it through an SSH tunnel instead.

Once you set a domain, the stack adds Caddy, a web server that gets and renews an HTTPS certificate for you. Nothing else is installed on the server.

Before you start

• Create a DNS record for your domain (for example mail.example.com) that points at the server.
• Make sure ports 80 and 443 are open on the server and its firewall. Port 443 is used over TCP, and over UDP for HTTP/3.

Set the domain

If you installed with the bootstrap script, run:

sudo bash bootstrap.sh domain mail.example.com

The script sets METIS_DOMAIN and changes BETTER_AUTH_URL to https://mail.example.com in .env, then redeploys the stack with Caddy. When it finishes, it prints “Live at https://mail.example.com”. Caddy gets the certificate on the first request, so the first page load can take a few seconds.

You can also set the domain during the install: export METIS_DOMAIN before you run the script, or type it at the prompt.

If you manage the stack yourself, see the last step of Install with Docker Compose.

Check the result

Open the Instance page under System in the owner dashboard. The App card shows the Public URL, and Secure cookies reads Yes once the address starts with https://.

If something goes wrong

If the certificate never arrives, check that DNS points at this server and that ports 80 and 443 are reachable from the internet. Caddy’s log shows what failed:

sudo docker compose --project-directory /opt/metis-suite logs caddy