Adding a domain and turning on HTTPS

A new website takes three steps: add the domain in Hostctl, point its DNS at the server, then request a free Let's Encrypt certificate. The certificate comes last because Let's Encrypt checks the domain by visiting it on this server.

Adding a domain never changes its public DNS. Until the domain's DNS points here, visitors still reach wherever it pointed before.

Adding a domain

1. Open Hosting → Domains and press Add Domain.
2. Enter the Domain Name without www, such as example.com. The site answers on www.example.com too.
3. Under Host with Hostctl, keep Web hosting for a website and Mail hosting for mailboxes here. Untick Mail hosting if your email is hosted elsewhere.
4. Leave Add default DNS records for selected services ticked, so the domain's DNS zone starts with the records it needs.
5. Pick a PHP Version and leave Document Root empty unless you need a different folder. The default is /var/www/example.com/httpdocs.
6. Press Add Domain.

Web and mail hosting are chosen once, when you add the domain, and can't be switched later. If your plan's domain limit is reached, the form says so.

Adding a subdomain

Open the domain, choose the Subdomains tab, enter a Subdomain name such as blog, and press Add Subdomain. The Document root (optional) defaults to /var/www/example.com/blog.example.com.

Hostctl adds an address record for the subdomain to the domain's DNS zone. A subdomain gets HTTPS only from a wildcard certificate (see below); otherwise it's served over plain HTTP.

Pointing DNS at the server

Hostctl keeps a DNS zone for each domain, but it doesn't answer DNS queries itself. The records must be published wherever your registrar sends DNS queries: your registrar's own DNS, or a DNS host such as Cloudflare or DigitalOcean.

Open the domain's DNS tab and press Open DNS Manager to see the records. Then either:

• Copy them by hand to your DNS host. For the website, that's the A record (and AAAA, if listed) for example.com and www.example.com, which hold the server's address. With mail hosting, copy the mail records too.
• Connect Cloudflare or DigitalOcean so Hostctl publishes them for you (see Using Cloudflare or DigitalOcean DNS).

DNS changes can take from a few minutes to a day to reach everyone.

Getting an HTTPS certificate

Once the domain's DNS points here:

1. Open the domain's SSL tab.
2. Check the Let's Encrypt email. It starts as the domain owner's address.
3. Tick Include www.example.com if visitors use the www address. Without it, https://www.example.com shows a certificate warning.
4. Leave Keep HTTP available after SSL is enabled off, so visitors are always sent to HTTPS.
5. Press Request Free SSL and watch the Certbot output.

Certificates renew by themselves about three weeks before they expire. The domain's page shows a warning when one has less than two weeks left.

If the request fails, the output says why. The usual cause is DNS that doesn't point here yet, for the domain or for www. Fix it, then press Retry issuance. To change what a working certificate covers, use Reissue Certificate.

After a certificate is active, Allow HTTP serves the site on plain HTTP as well, and Redirect HTTP sends everyone to HTTPS again.

Covering every subdomain at once

Use one wildcard certificate for all subdomains requests one certificate for example.com and *.example.com. Let's Encrypt checks a wildcard through DNS, so the domain's DNS must be hosted at Cloudflare, with Cloudflare chosen as its provider in Hostctl (see below). DigitalOcean DNS can't be used for a wildcard.

Using Cloudflare or DigitalOcean DNS

In DNS Manager, under Domain DNS provider, choose the Provider override and press Save provider preference. Use panel default uses whatever your host set up. To use your own account, paste a token for the domain:

• Cloudflare: a scoped API token with Zone Read and DNS Edit for this domain. Global API keys aren't supported. Test saved Cloudflare access checks that it can read the zone.
• DigitalOcean: a personal access token that can read and change your domains.

Hostctl never creates the zone or changes nameservers. Add the domain at Cloudflare or DigitalOcean first, and set the nameservers at your registrar.

Cloudflare: press Link Zone. Hostctl finds the zone and adds any local records Cloudflare doesn't have yet. Sync does that again later. Refresh from Cloudflare shows what's live there, and Import to Local DNS copies it into Hostctl.

DigitalOcean: press Link existing zone. Linking only reads. Sync all to DigitalOcean publishes the local records, Refresh remote records shows what's there, and Import remote records copies it into Hostctl.

Once a zone is linked, records you add, edit or delete in DNS Manager change at the provider straight away. Syncing never deletes records that exist only at the provider. A record marked Pending sync hasn't reached the provider yet. Changing the provider or token unlinks the zone without touching the records there.

The site loops or says "too many redirects" behind Cloudflare

If Cloudflare's proxy connects to the server over plain HTTP (its SSL mode Flexible), every request is redirected back to HTTPS in a loop. The domain's Overview warns about this. In Cloudflare, set SSL/TLS to Full (strict). If you can't change it, press Serve HTTP without redirecting in the warning instead; traffic between Cloudflare and the server is then unencrypted.