Connecting Your Own Domain

In this article, we will explain in detail how to connect your own domain to the Tuna platform and publish a local website to the internet without a public IP, complex network configurations like VPN, and without deploying code to any server or hosting.

Publishing on your own domain can be interesting for Demo stands when you present a solution to a client. The client sees a finished solution while you haven't spent a minute on environment preparation, and you can also fix small things on the fly. However, there can be many more use cases.

Connecting a Domain

Purchasing a Domain

First, you'll need your own domain (if you don't have one). You can buy it, for example, from Reg.ru or namecheap or any other domain registrar. For examples in this article, we use the domain tuna-dev.ru.

Connecting to Tuna and Getting Settings

Go to the domain management page in your personal account and click Add domain in the top right corner.

Select the Own domain type and enter your domain in the Domain field. In our case, it's api.tuna-dev.ru. If you have a Unicode domain, for example in one of these zones .РФ, .ДЕТИ, .ҚАЗ, you need to specify the converted punycode variant.

After specifying your domain, you will see the required DNS settings.

DNS Configuration

Go to the DNS records management panel and create the record shown in the dashboard. For a subdomain like api.tuna-dev.ru, this is a CNAME: it points to the Tuna infrastructure as a whole rather than to a specific server, so the domain works with fault tolerance. An apex domain like tuna-dev.ru can't be connected with a CNAME; there is a separate option for it. If you have an AAAA record specified for the selected domain, it needs to be deleted, as IPv6 is not currently supported.

Waiting for Confirmation

After creating the DNS record, you can return to your personal account and click Add. The domain will enter verification mode.

Validation usually takes from 15 minutes to 2 hours but can extend to a couple of days, depending on the DNS record TTL. The verification process is limited to 24 hours and is divided into 2 main stages:

• DNS Check - we verify that your domain is configured correctly
• TLS Check - we issue a Let's Encrypt certificate for your domain

If the addition process failed with a DNS error, check that you correctly created the DNS record and it points to the correct server. If everything is correct, the DNS cache may not have updated yet and you need to wait, then simply resume the verification. If the addition process failed with a TLS error, check if there are obvious errors in the DNS configuration: AAAA records, recursively looped pointers. If you can't figure it out yourself, contact support.

Usage

After successful domain verification, you will receive a notification email.

Now you can start using it. To do this, add the --domain flag or its short variant -d or an environment variable and your domain to the tuna http <your_port> command, for example:

tuna http 8080 --domain=api.tuna-dev.ru

tuna http 8080 -d api.tuna-dev.ru

export TUNA_DOMAIN=api.tuna-dev.ru
tuna http 8080

Apex Domain

An apex domain is the domain itself without a subdomain: example.com, not www.example.com. DNS rules don't allow a CNAME on it, only A records pointing to specific addresses. Such a domain works, but without fault tolerance: if one of the addresses changes or becomes unavailable, some visitors won't be able to open the site.

That's why, when you add an apex domain, the dashboard asks you to choose how to connect it.

Site on a Subdomain, with Fault Tolerance

This is the option we recommend. The tunnel runs on a subdomain: www.example.com by default, but you can choose your own, for example shop.example.com. The subdomain is connected with a CNAME, the apex with A records. Once both domains pass the DNS check, Tuna creates a gateway with a permanent redirect (code 308) from example.com to the subdomain. The page path is kept: example.com/catalog opens www.example.com/catalog.

After you add the domain, the dashboard shows the DNS records for both domains and the command to start a tunnel on the subdomain:

tuna http 8080 --domain=www.example.com

Once both domains pass the check, the apex in the list gets a redirect mark:

The pair of domains takes two slots in your custom domain limit. If only one slot is free, the subdomain option is unavailable, and a link to upgrade your subscription appears next to it.

What to know about the redirect:

• The query string isn't kept on redirect: example.com/catalog?utm_source=mail opens www.example.com/catalog. Point links with UTM tags straight to the subdomain.
• The redirect gateway is visible in the Gateways section. If you delete it, the redirect turns off, and the apex domain card gets a button to turn it back on.
• While the gateway runs on the apex, a tunnel on example.com won't start: the server responds with Domain already reserved by gateway.
• If you delete the subdomain, the apex gateway stays and keeps redirecting to the deleted address. Delete it manually in the Gateways section.

Apex Domain Only

The apex is connected with A records to every address of the cell, and the tunnel runs on example.com. Such a domain has no fault tolerance, and the dashboard warns you about it.

How to Migrate an Already Connected Domain

Apex domains connected earlier and subdomains on A records are marked with a warning icon in the list.

For an apex domain, the card has a step-by-step migration:

1. Add a subdomain for the site. The dashboard shows the CNAME record to create at your registrar.
2. Start the tunnel on the subdomain instead of the apex. Stop the tunnel on the apex: while it runs, the redirect won't turn on.
3. Turn on the redirect to the subdomain. The button becomes available once the subdomain passes the DNS check. The redirect starts working in about a minute.

Old links keep working: visitors coming to example.com land on the same pages of the subdomain.

If a subdomain is connected with A records, you don't need to change the tunnel or settings. Replace the A records with a single CNAME record from the domain card. The warning disappears after the next DNS recheck, which runs once a day.