Deploy a web app on Ownkube Compute and it gets a working *.ownkube.app address with HTTPS the moment it goes live, automatically, with nothing to request and nothing to renew. That’s the default for every app: no cloud account, no config, no certificate to manage.
Some apps also need a domain the business already owns, yourcompany.com instead of yourcompany.ownkube.app. Ownkube manages that certificate too, today on a Starter (K3s) cluster in your own AWS account: one setup per domain, then any subdomain or the root domain itself can point at an app with a single DNS record.
This guide covers what you get on Ownkube Compute by default, where custom domains apply today, and how to register a domain and link it to a public web app.
TL;DR
- Every Ownkube Compute app already has automatic HTTPS on its own
*.ownkube.apphostname, no setup required. That’s the default and it needs nothing from you. - Serving an app on a domain you own is available today on a Starter (K3s) cluster in your own AWS account. Custom domains on Ownkube Compute are on the roadmap, not shipped yet.
- On Starter, register the parent domain once in the cluster’s Networking settings. Ownkube issues a single certificate that covers the root domain and every subdomain under it, and shows you a one-time delegation record to add.
- After that record verifies, link any host, a subdomain like
app.yourcompany.comor the rootyourcompany.comitself, to a public web app from that app’s own settings. - Each linked host needs exactly one DNS record of its own: a CNAME for a subdomain, an A record for the root. Ownkube never asks for your whole domain’s nameservers.
What you get by default on Ownkube Compute
If you’re deploying on Ownkube Compute, the no-cloud managed compute most personal projects and small teams start on, automatic HTTPS is already there. Every web deployment gets a public *.ownkube.app hostname with a valid certificate from the moment it’s live, no action needed. For a lot of apps, that’s the whole story: a working HTTPS address, done.
Before you start (custom domains)
Custom domains, putting your own yourcompany.com in front of an app, are a Starter (K3s) cluster feature today, on public web apps only, and need a recent platform version. They are not available on Ownkube Compute yet (it’s on the roadmap). If you want a domain you own on the app today, run it on a Starter cluster in your own AWS account instead. The same app definition works either way, no rewrite, so this isn’t a decision you’re locked into.
Register the domain on your cluster
- Open your cluster’s dashboard page and go to the Networking pane.
- In Custom domains, type the parent domain you own, for example
yourcompany.com, and click Add. - Ownkube shows a one-time certificate verification record: a CNAME with a specific name and target. Add it at your DNS provider (wherever
yourcompany.comis currently managed). - Back in the dashboard, click Verify DNS on the domain once the record has propagated. Status moves from pending to verifying to active as Ownkube confirms the delegation and issues the certificate.
This one record is what lets Ownkube prove you own the domain and keep the certificate renewed automatically. It does not touch your existing nameservers or any other records already on the domain, so anything else you’re running on yourcompany.com is untouched.
Once the parent domain is active, its certificate covers the root domain and every subdomain beneath it. You will not need to repeat this step for each app.
Link a host to your app
With the parent domain active, go to the public web app you want to serve on it:
- Open the app’s Settings tab and find the Custom domains section.
- Enter the host you want: a subdomain like
app.yourcompany.com, or the root domainyourcompany.comitself if you want this app to be the site people land on. - Click Link. Ownkube shows a traffic routing record to add: a CNAME for a subdomain, an A record if you linked the root.
- Add that record at your DNS provider. The host comes online automatically once it resolves, no second verify click needed.
# From the CLI: link a host to a deployment
okctl domains add <deployment-id> app.yourcompany.com
# Check status and see the DNS records to add
okctl domains list <deployment-id>
# Re-check DNS after adding a record
okctl domains verify <domain-id>You can link more than one host to the same domain to different apps, an app.yourcompany.com for your product and the root yourcompany.com for a marketing site, for instance, and each only needs its own single routing record.
Verify it’s live
Once a linked host shows active, hit it in a browser. You should see a valid certificate for your domain (not *.ownkube.app) and your app’s response. If it’s stuck on pending, double-check the exact record name and target Ownkube showed you against what’s actually saved at your DNS provider: a typo in the CNAME target is the most common reason a host doesn’t come online.
Removing a domain or host
Unlinking a host from an app (or removing the parent domain from the cluster entirely) stops routing for it immediately. Removing a parent domain that still has linked apps takes those apps offline over HTTPS until you move them to another domain, so unlink hosts first if you’re migrating away from a domain rather than retiring it.
FAQ
Does this work with Ownkube Compute, or only my own AWS account?
Custom domains ship today on Starter (K3s) clusters in your own AWS account. Ownkube Compute apps have automatic TLS on their *.ownkube.app address, but attaching your own domain to a Compute app is not available yet.
Do I need a separate certificate for each subdomain?
No. One certificate per parent domain covers the root and every subdomain under it. You only go through the one-time delegation record once per domain, not once per app.
Can I point my domain’s root (the apex) at an app instead of a subdomain?
Yes. Link the bare domain (yourcompany.com) the same way you’d link a subdomain; Ownkube gives you an A record to add instead of a CNAME, since most DNS providers don’t allow a CNAME at the apex.
Does Ownkube ever ask me to change my domain’s nameservers?
No. Every step adds exactly one record, either at the domain level (the certificate delegation) or at the host level (traffic routing). Ownkube never asks you to delegate the whole zone.
What if the certificate or the linked host gets stuck on pending?
Check that the DNS record you added matches the name and target shown in the dashboard exactly, then click Verify DNS (for the parent) or wait for the automatic recheck (for a linked host). Propagation can take a few minutes depending on your provider’s TTL.
Where Ownkube fits
If you want your own domain on an app with a certificate you never have to renew by hand, Ownkube handles the whole chain: one delegation record per domain, one routing record per host, and automatic status tracking in between. It’s a Starter (own AWS) capability today, and the same app moves there from Ownkube Compute with no rewrite if that’s where you started. For a closer look at how DNS and TLS setup compares to other platforms, see our self-hosted PaaS comparison and Railway vs. Render vs. Northflank. Deploy your first app.
