# Public hostnames and TLS

> Every public web app on Ownkube gets a <name>.ownkube.app hostname with a managed TLS certificate. How the hostname is chosen, how to change it, and what happens on the edge.

A web app with **Public hostname** on is reachable at `https://<subdomain>.ownkube.app` the moment its first rollout is healthy. Ownkube allocates the hostname, issues and renews the TLS certificate, and routes requests to your container's port. There is nothing to configure.

## How the hostname is chosen

- The subdomain is derived from the deployment name. If it is taken, Ownkube suggests a free variant.
- It has to be a valid DNS label: lowercase letters, digits and hyphens, up to 63 characters, no leading or trailing hyphen.
- Workers, jobs, databases and caches have no public hostname of their own. A database or cache gets a separate hostname when you turn on **Public access**; see [Postgres](/docs/data/postgres#public-access).

## Change the hostname

1. Open the deployment's **Overview** tab and click **Edit** next to the hostname.
2. Type a new subdomain. Ownkube checks availability as you type.
3. Save. The new hostname is live within a minute. The old one stops resolving: update anything that linked to it.

From the terminal:

```bash
okctl deploy subdomain check my-app        # is it free?
okctl deploy subdomain suggest <id>        # suggestions near the current name
okctl deploy subdomain set <id> my-app     # change it
```

## What the edge does for you

- **TLS**: a certificate for `*.ownkube.app` terminates HTTPS at the region edge. Your container speaks plain HTTP on its port.
- **Routing**: the edge routes to the healthy replicas of your app. During a [rollout](/docs/deployments#how-a-rollout-works) only replicas that pass their [health checks](/docs/deployments/health-checks) receive traffic.
- **Wake on request**: if the app is [asleep](/docs/deployments/sleep), the edge holds the request while it starts.
- **Access protection** (own cloud only): put a password in front of the hostname. See [Access protection](/docs/own-cloud/access-protection).

## Metrics on the hostname

Because requests pass through the edge, Ownkube can show **request rate by status class, p95 latency and network in and out** for any app with a public hostname. See [Metrics](/docs/observability/metrics).

## Bandwidth

Traffic leaving the region to the internet is billed per GB at the region's rate; inbound traffic and traffic inside the region are free. See [Regions](/docs/deployments/regions) and [Understanding your bill](/docs/billing/usage).

## Your own domain

On Ownkube Compute, apps are served on `*.ownkube.app` only. If you need `app.example.com`, run the app on a Starter cluster in your own AWS account, where Ownkube manages a certificate for your domain, including the root domain. See [Custom domains](/docs/own-cloud/custom-domains).

- [Private networking](/docs/networking/private)
- [Health checks](/docs/deployments/health-checks)
- [Custom domains](/docs/own-cloud/custom-domains)

---

**Don't see a feature you need?** Email [support@ownkube.io](mailto:support@ownkube.io?subject=Feature%20request). Ownkube is shaped by the teams using it and we ship what our users ask for.

## Search

This site has a search endpoint: https://context7.com/api/v2/ask?siteKey=ask_c64dfe8ffaa8d3ad19576838&query=<URL-encoded question>. It returns documentation that answers the question, with a source link for each part. No API key is needed. If nothing matches, it says so.