Adding a domain

Free domainsCopy Anchor Link

A free domain needs no DNSThe system that points a domain name at a server's address. For your own domain, you add a record at your domain provider. setup, so it's the quickest way to get a service online.

It's a nip.ioA free service that answers any name ending in an IP address with that address. name with your cluster's address in it, like shop-web.203.0.113.7.nip.io. Each cluster picks which address its free domains use, under Free domains on its Settings tab:

• Public IP: the cluster's public address. Anyone on the internet can reach it, and it gets a Let's Encrypt certificate.
• Tailscale: a server's Tailscale address, like shop-web.100.101.67.2.nip.io. Only devices on your tailnetYour private Tailscale network. Only devices you've added to it can reach addresses on it. can reach it. Pyo Gateway answers there on ports 80 and 443 even while the cluster's public traffic is off.

By default, a cluster uses Public IP when it takes public traffic and a server has its public address itself, on its network card or as its external IP, or a load balancer gives it one. A server behind NATA router or provider that shares one public address between machines. Connections from the internet only reach a machine when a port is forwarded to it., like one at home or with some cloud providers, only knows its public address from the internet's side. Ports 80 and 443 may not reach it, so the cluster uses Tailscale and the setting says Behind NAT. Choose Public IP there if ports 80 and 443 are forwarded to the server.

When you change it, the cluster's free domains move to the new address within seconds. A cluster without the chosen address has no free domain. Add your own domain instead.

Custom domainsCopy Anchor Link

Add your domain to a service, then point its DNS at your cluster. Pyo checks the DNS and tells you when the domain is active.

Changing domainsCopy Anchor Link

Adding or removing a domain, or changing its HTTPS settings, takes effect within seconds. You don't need to redeploy, and the service keeps running. A service that hasn't been deployed yet gets its domains with its first deploy.

Domains belong to the service, not to a deployment, so a rollback keeps the domains the service has now.

CertificatesCopy Anchor Link

Pyo picks a certificate for you:

• Public domains get a Let's EncryptA free service that issues the certificates browsers need for HTTPS. Pyo requests and renews them for you. certificate, issued and renewed automatically.
• Private domains, on a tailnetYour private Tailscale network. Only devices you've added to it can reach addresses on it. or LAN, get a self-signed certificateA certificate Pyo makes itself. The connection is still encrypted, but browsers show a warning because no public authority vouches for it..

You can also use your own certificate, including wildcards.

Requests to your domains go through Pyo Gateway on each server.

Other kinds of trafficCopy Anchor Link

Services aren't limited to websites. A port can be:

• Private: reachable only inside the cluster. Use this for databases and internal APIs.
• Website: an HTTP service on a domain.
• Port on every server: a TCP or UDP port on each server in the cluster.
• Public IP: a public TCP or UDP port, for a game server or a database you reach from outside.

Only private ports are reachable while the cluster's public traffic is off. With free domains on Tailscale, websites stay reachable from your tailnet too.

Public TCP and UDP portsCopy Anchor Link

A Public IP port goes Through the gateway by default. The gateway counts its connections in analytics. For TCP, you can add IP rules, a connection limit and PROXY protocol. The firewall applies to these ports too.

Turn the switch off to open the port directly on the servers instead. Your service then sees each visitor's address itself. Only servers running one of its replicas answer on the port. The port has no analytics or gateway options. Switching a port between the two interrupts it for about 1 to 3 seconds.

Each cluster can have one public port per number and protocol. Inside the gateway, ports below 1024 are moved up by 10000. For example, 123 and 10123 can't both go through the gateway.

Some ports can't be public, because the servers or Pyo use them: