DNS & TLS

lnkify requires four hostnames pointed at your server. Caddy handles TLS automatically — no manual certificate management is needed.

Required DNS Records

Create A records (and optionally AAAA records for IPv6) pointing all four hostnames to your server's public IP address:

Type	Name	Value
A	lnkify.io	<your-server-ip>
A	app.lnkify.io	<your-server-ip>
A	mcp.lnkify.io	<your-server-ip>
A	docs.lnkify.io	<your-server-ip>

If you're using a subdomain (e.g., ln.example.com), adjust accordingly:

Type	Name	Value
A	ln.example.com	<your-server-ip>
A	app.ln.example.com	<your-server-ip>
A	mcp.ln.example.com	<your-server-ip>
A	docs.ln.example.com	<your-server-ip>

Configuring DNS at Your Provider

Cloudflare

1. Go to your domain's DNS settings.
2. Add four A records with the names above, pointing to your server IP.
3. Set Proxy status to DNS only (gray cloud). The orange cloud (proxied) will interfere with Let's Encrypt HTTP challenges.
4. TTL can be set to Auto.

AWS Route 53

1. Open the hosted zone for your domain.
2. Click Create record → Simple routing.
3. For each subdomain, create an A record with your server IP as the value.
4. TTL: 300 (5 minutes) is reasonable for initial setup; increase later.

Namecheap (or similar registrars)

1. Go to Domain List → Manage → Advanced DNS.
2. Add four A Record entries with Host set to @ (for apex), app, mcp, and docs, and Value set to your server IP.
3. TTL: Automatic or 5 minutes.

Verifying DNS

Use dig or nslookup to confirm DNS propagation:

dig lnkify.io +short
dig app.lnkify.io +short
dig mcp.lnkify.io +short
dig docs.lnkify.io +short

Each should return your server's IP address. DNS propagation can take anywhere from a few minutes to 48 hours, though most providers update within minutes.

Firewall Configuration

Ensure your server's firewall allows inbound traffic on ports 80 and 443:

# UFW (Ubuntu)
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# firewalld (CentOS/RHEL)
sudo firewall-cmd --permanent --add-port=80/tcp
sudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --reload

Also verify your hosting provider's network-level firewall (e.g., AWS Security Groups, DigitalOcean Cloud Firewall) allows these ports.

How TLS Works

When Caddy starts, it:

1. Receives a request for https://lnkify.io.
2. Checks its certificate storage (caddy_data volume) for a valid certificate.
3. If no valid certificate exists, Caddy initiates an ACME challenge with Let's Encrypt:
   • HTTP-01 challenge: Let's Encrypt makes a request to http://lnkify.io/.well-known/acme-challenge/.... Caddy responds with the challenge token, proving domain ownership.
   • TLS-ALPN-01 challenge: Used as a fallback on port 443.
4. On success, Let's Encrypt issues a certificate. Caddy stores it in caddy_data and serves HTTPS.
5. Certificates auto-renew 30 days before expiry. Caddy runs a background goroutine that checks expiry daily.

No manual intervention is required for the entire certificate lifecycle.

TLS Certificate Storage

Certificates, account keys, and OCSP staples are stored in the caddy_data Docker volume:

docker volume inspect lnkify_caddy_data

This volume persists across docker compose down and docker compose up. To reset certificates (e.g., if switching domains), remove the volume:

docker compose down
docker volume rm lnkify_caddy_data

Testing TLS

Verify your TLS setup with curl:

curl -vI https://lnkify.io

Look for:

• SSL connection using TLSv1.3 (or TLSv1.2)
• subject: CN=lnkify.io in the certificate chain
• A 200 OK or 301 Moved Permanently response

Test certificate expiry:

echo | openssl s_client -servername lnkify.io -connect lnkify.io:443 2>/dev/null | openssl x509 -noout -dates

docs.lnkify.io TLS

The documentation site receives the same automatic TLS treatment. Caddy handles the certificate for docs.lnkify.io identically to the main domain. No additional configuration is needed.

Troubleshooting TLS

If Caddy cannot obtain a certificate:

1. DNS not propagated — Wait and retry. Use dig to confirm.
2. Port 80 blocked — Let's Encrypt HTTP-01 challenges require port 80 to be reachable from the internet.
3. Firewall — Double-check host and network firewalls.
4. Rate limiting — Let's Encrypt has rate limits. If you've requested many certificates recently, wait an hour before retrying.
5. Check Caddy logs — docker compose logs caddy | grep -i error

Next: Reverse Proxy