Ingress, Custom Domains and TLS

You want your application reachable from the internet on your own domain, over
HTTPS. You configure the hostname on the Component in SVIEW, point your DNS at
the platform load balancer, and the platform issues and renews the TLS
certificate for you.

Before you start

• You can edit the application Component's configuration in SVIEW.
• You control the DNS zone for the domain you want to use.
• You know the load balancer address for the Environment. It is shown in the
  SVIEW Environment view — ask in your support channel if you cannot find it.

How it works

1. You set the hostname and routing rules in the Component's configuration in
   SVIEW.
2. The platform creates the routing rule and sends matching traffic to your
   application.
3. The platform requests a TLS certificate for that hostname and renews it
   automatically before expiry.
4. You point your DNS record at the platform load balancer.

CTO2B manages the ingress layer, the load balancer, and certificate issuance
and renewal. You manage your DNS records and the hostname configuration on the
Component.

Configure the hostname in SVIEW

1. Open the application Component in SVIEW.
2. Add an ingress block to its configuration:

ingress:
  enabled: true
  hostname: myapp.yourdomain.com
  tls: true

3. Click Save.

The routing rule is created immediately. Certificate issuance typically
completes within 1 to 2 minutes once the hostname resolves publicly.

Point your DNS at the platform

1. Take the load balancer address from the SVIEW Environment view.
2. In your DNS provider, create the record:
   • CNAME for a subdomain (for example myapp), with the load balancer
     hostname as the value.
   • A record for an apex domain, with the load balancer address as the
     value.
3. Wait for propagation, which usually takes a few minutes.

Once the record resolves, your application is reachable over HTTPS.

Verify it worked

• The Component shows a healthy status in SVIEW.
• Your hostname resolves to the load balancer address.
• The site loads over https:// with no certificate warning.

TLS certificates

Certificates are issued and renewed automatically for every hostname you
configure in an ingress block. There is nothing to upload, install, or
rotate, and no action is needed from your team at renewal time.

The one requirement is public DNS resolution: the hostname must resolve to
the platform load balancer before a certificate can be issued. If you configure
the hostname first, issuance is retried automatically once the DNS record
exists.

If your domain is internal only and never resolves publicly, raise a request so
the team can discuss the alternatives with you.

Wildcard certificates

A wildcard certificate such as *.yourdomain.com is validated differently: it
requires a DNS-based challenge, which means the platform needs access to your
DNS provider's API. Raise a request if you need one, and the team will go
through the configuration options with you.

CloudFlare traffic shielding

You can restrict the load balancer so that it only accepts traffic that arrived
through CloudFlare, and rejects requests made directly to the load balancer
address. This makes sure every request passes through CloudFlare's DDoS
protection and WAF. It is available on both AWS and GCP.

Before requesting it:

• CloudFlare Proxy (the orange cloud) must already be active on the domain.
  Shielding only works if traffic genuinely passes through CloudFlare.
• Review any integration, monitoring agent, or API consumer that calls your
  endpoints directly rather than through your public domain. Those calls will
  be blocked once shielding is on.

To enable it, raise a request. CTO2B reviews your current ingress traffic
before applying the restriction.

What CTO2B manages, and what you manage

Related articles

• Troubleshooting
• Promoting a Service's Ingress to a New Environment