---
title: Domain and HTTPS
description: Serve your instance on your own domain with an automatic HTTPS certificate.
---

Until you set a domain, the app listens only on the server itself, at `127.0.0.1:3000`. Without HTTPS, sign-in cookies are not marked secure, so the app is not exposed to the internet. You reach it through an SSH tunnel instead.

Once you set a domain, the stack adds Caddy, a web server that gets and renews an HTTPS certificate for you. Nothing else is installed on the server.

## Before you start

- Create a DNS record for your domain (for example `mail.example.com`) that points at the server.
- Make sure ports 80 and 443 are open on the server and its firewall. Port 443 is used over TCP, and over UDP for HTTP/3.

## Set the domain

If you installed with the bootstrap script, run:

```bash
sudo bash bootstrap.sh domain mail.example.com
```

The script sets `METIS_DOMAIN` and changes `BETTER_AUTH_URL` to `https://mail.example.com` in `.env`, then redeploys the stack with Caddy. When it finishes, it prints "Live at https://mail.example.com". Caddy gets the certificate on the first request, so the first page load can take a few seconds.

You can also set the domain during the install: export `METIS_DOMAIN` before you run the script, or type it at the prompt.

If you manage the stack yourself, see the last step of [Install with Docker Compose](/self-hosting/install/install-with-docker-compose).

:::warning[Update your OAuth redirect URIs]
The redirect URIs for Google, Microsoft and Zoho are built from your app's address. After you change the domain, open each provider page under **Dashboard**, **System**, copy the new **Redirect URI** and register it in the provider's console. Until you do, connecting those accounts fails. See [Sign-in providers](/self-hosting/configure/sign-in-providers).
:::

## Check the result

Open the **Instance** page under **System** in the owner dashboard. The **App** card shows the **Public URL**, and **Secure cookies** reads **Yes** once the address starts with `https://`.

## If something goes wrong

| Message | What to do |
| --- | --- |
| `Usage: bootstrap.sh domain <yourdomain.com>` | Add the domain name after `domain`. |
| "No deployment in /opt/metis-suite" | Install the stack first with `sudo -E bash bootstrap.sh`. |

If the certificate never arrives, check that DNS points at this server and that ports 80 and 443 are reachable from the internet. Caddy's log shows what failed:

```bash
sudo docker compose --project-directory /opt/metis-suite logs caddy
```