Domains and SSL
Custom domains, automatic SSL and Traefik routing.
Exposing a service to the internet happens on the Domains tab inside the service. Add a domain — a bare name or a wildcard — and ZenSailor configures Traefik to route traffic and obtain the certificate.
- Automatic SSL: adding a domain makes ZenSailor ask Let's Encrypt for a certificate; renewal is automatic.
- Custom certificates: upload your own TLS certificate per domain when you need one (e.g. for an internal CA); Traefik falls back to Let's Encrypt when no custom certificate is configured.
- Internal DNS: services can talk to each other by name within an
environment — a backend reaches a database service at
postgres://db:5432without a port mapping. - TCP routing: in Let's Encrypt mode,
db.<domain>routes Postgres and other raw-TCP services over TLS using SNI routing. - WebSockets and HTTP/2 are supported by the router out of the box.
- Domain health checks verify reachability from the router, accept self-signed certificates for local domains, and surface routing problems before traffic breaks.
Wildcards
Add *.example.com to serve one service across subdomains — the basis of
preview environments and per-tenant domains.
Works on local domains too
.local, .lan and similar hostnames are detected by the installer and
served with self-signed or no TLS, so the same workflow applies on a LAN.
DNS before you add the domain#
Point the DNS record at your server before adding the domain, so the Let's Encrypt challenge can complete on the first try. The domain list shows configuration and reachability state for each record.
Zero config for services behind the router#
Newly deployed services are reachable at their internal name inside the environment's network. Only the domains you add are exposed publicly — default-deny applies to everything else.