Add a custom domain

Bind your own domain to a deployed app. The TLS cert is issued and renewed for you; you only touch DNS.

Prereqs

• A deployed app (see Deploy a Next.js app for the first deploy)
• A domain you control with registrar / DNS access
• Either the console or a connected agent — both paths work

1. Pick a hostname.

   Apex (example.com) or subdomain (app.example.com) — both work, and both use record types every registrar supports.

2. Bind the domain to your app.

   Console

   Apps → <your app> → Hosts → Add custom domain. Paste the hostname, click Add. The page shows the DNS target you need to point at next.

   Via your agent

   add example.com to my widget app on nyxory

   Your agent resolves your project (via nyx_project_list / nyx_app_list), calls nyx_domain_add with the hostname, app, and project, and reports back the DNS target.

   CLI

   nyx domain add example.com --app widget

3. Point your DNS at the returned target.

   The response gives you the exact target to use.

   • Subdomain: add a CNAME from your hostname to the target the platform publishes.
   • Apex (example.com): add an A record pointing at the IP the response returns. Every registrar supports A records — no ALIAS/ANAME workaround needed.

4. Wait for the cert.

   nyx domain status example.com --watch

   Or refresh the console Hosts panel. Typical first issuance: 2–5 minutes. The cert auto-renews thereafter — you don’t touch it again.

5. Verify.

   curl -I https://example.com

   Expect 200 OK and a valid Let’s Encrypt cert.

Listing + removing

nyx domain list                       # all your bound domains
nyx domain list --app widget          # just one app
nyx domain remove example.com         # detach + revoke

Troubleshooting

Caution:

• DNS not propagated. Run dig example.com and check it resolves to the target the response gave you. If it doesn’t show up yet, your registrar hasn’t propagated — wait 60 seconds and re-check.
• CAA records blocking the cert. If you have a CAA record at the apex that doesn’t include letsencrypt.org, the issuance fails silently. Either remove the CAA or add a 0 issue "letsencrypt.org" entry.
• CertPending for more than 10 minutes. Something’s wrong upstream. Open the console’s domain detail — it surfaces the latest provisioning event. If you’re stuck, nyx domain remove + re-add usually clears it.