Domain and SSL Configuration
This guide covers the DNS records required by the platform, then installs Nginx, adds the routes to the application, and issues an SSL certificate so the domain is reachable over HTTPS.
Domain and DNS Configuration
Step 1: Configure the Primary On-Premises Domain
In the DNS provider that manages the customer's domain (Cloudflare, GoDaddy, Route53, etc. - whoever controls their domain, not necessarily Authnull), create an A record:
| Type | Name | Value |
|---|---|---|
| A | onprem.customer-domain.com | SERVER_PUBLIC_IP |
SERVER_PUBLIC_IP is this VM's public IP address - the same value set as SYSTEM_IP in the .env file during Installation.
Step 2: Verify DNS Resolution
dig +short onprem.customer-domain.com @1.1.1.1
Step 3: Configure the Tenant Domain
In the DNS provider that manages the customer's domain, create an additional A record for the tenant subdomain:
| Type | Name | Value |
|---|---|---|
| A | default.customer-org-name.customer-domain.com | SERVER_PUBLIC_IP |
Step 4: Verify Tenant DNS Resolution
dig +short default.customer-org-name.customer-domain.com @1.1.1.1
SSL Certificate and Nginx Configuration
The domain was already pointed to this server's IP address in the previous steps. This section installs Nginx, opens the required firewall ports, issues an SSL certificate, and adds the routes to the application.
Step 5: Install Nginx
sudo apt update
sudo apt install -y nginx
sudo systemctl status nginx
Step 6: Configure Firewall Ports
sudo ufw enable
sudo ufw allow 80
sudo ufw allow 443
sudo ufw status
Open ports 80 and 443 before requesting certificates - Certbot must be reachable on port 80 to complete the domain validation challenge in Step 8.
Step 7: Install Certbot
sudo apt install -y certbot python3-certbot-nginx
Step 8: Obtain SSL Certificates
Request a certificate for each domain - the primary on-premises domain and the tenant domain:
sudo certbot certonly --nginx -d onprem.customer-domain.com
sudo certbot certonly --nginx -d default.customer-org-name.customer-domain.com
This creates the certificate files at /etc/letsencrypt/live/onprem.customer-domain.com/fullchain.pem and privkey.pem, used in the Nginx configuration below.
Step 9: Configure Nginx Upstreams
Edit the Nginx config:
sudo nano /etc/nginx/nginx.conf
An example nginx.conf file is included in the deployment package. Use it as a reference and update the routes according to the customer's domain.
Step 10: Test and Reload Nginx
sudo nginx -t
sudo systemctl reload nginx
Repeat this test-and-reload step after adding each server block - both the primary on-premises domain and the tenant domain.
Next Steps
Continue to Organization and Tenant Setup to register your organization.