SERVER / TLS

Own HTTPS in the Dowe runtime

Dowe issues, caches, and renews multi-domain Let's Encrypt certificates without Certbot, Node.js, or an external reverse proxy.

1 / ACME

Declare every public hostname

TLS-ALPN-01 runs on the HTTPS listener. The cache lives below .dowe, staging is safe by default, and certificate state is polled for automatic renewal.

dowe
main
  server port:443
    tls:
      mode:"acme"
      domains:["example.com" "www.example.com"]
      email:"admin@example.com"
      staging:false
Concern
What Dowe does

No data

There are no records to display

2 / MANAGED DOMAINS

Feed domains from Dowe data

A reverse proxy or application platform can load domains from local Dowe data or an authenticated HTTPS control plane. Dowe validates and reloads the effective set when it changes.

dowe
tls:
  mode:"acme"
  domains:["platform.example.com"]
  email:"ops@example.com"
  staging:false
  domainsFrom:{
    endpoint:env.CONTROL_PLANE_URL
    path:"/v1/domains"
    bearer:env.CONTROL_PLANE_TOKEN
    timeoutMs:5000
  }
  refreshSeconds:30
  httpPort:80
Concern
What happens

No data

There are no records to display

Owner
Responsibility

No data

There are no records to display

3 / LOCAL DEVELOPMENT

Use a self-signed localhost certificate

Let's Encrypt does not issue localhost certificates. Local mode creates an ephemeral self-signed certificate without modifying the system trust store.

dowe
main
  server port:8443
    tls:
      mode:"local"
      domains:["localhost" "app.localhost"]