DNS Providers and Automatic HTTPS

SHC supports automatic DNS record management and HTTPS certificate issuance via integration with DNS providers and Traefik’s ACME support.

When deploying apps with --host, SHC can:

1. Create DNS records pointing to your deployment
2. Configure Traefik to issue HTTPS certificates via Let’s Encrypt

Configure DNS providers in your SHC config:

dns:
  providers:
    cloudflare:
      token: ref+vault://dns/cloudflare_token
    route53:
      region: us-east-1
      access_key_id: ref+vault://dns/aws_access_key
      secret_access_key: ref+vault://dns/aws_secret_key
  # Optional: explicit default provider
  provider: cloudflare

All providers support Traefik DNS-01 challenges automatically.

If dns.provider is not set, SHC uses the first key in dns.providers.

# Create DNS record pointing to current node
shc install nginx --host app.example.com

# HTTPS with HTTP-01 challenge (default)
shc install nginx --host app.example.com --tls

# HTTPS with DNS-01 challenge
shc install nginx --host app.example.com --tls dns

# Use specific provider for this deployment
shc install nginx --host app.example.com --dns-provider route53

# Uninstall releases the deployment's managed-DNS records automatically
shc uninstall myapp

Without --tls, the app is accessible only via HTTP.

When using --tls (without additional arguments):

• Domain must resolve to the Traefik instance
• Port 80 must be accessible from the internet
• Traefik handles certificate issuance and renewal

When using --tls dns:

• DNS provider credentials must be configured
• Works for internal/private networks
• Required for wildcard certificates

SHC automatically selects the appropriate DNS record type:

DNS provider selection follows the same scoping rules as other SHC config:

1. --dns-provider CLI flag (highest priority)
2. dns.provider at deployment scope
3. dns.provider at environment scope
4. dns.provider at stack scope
5. dns.provider at tenant scope
6. dns.provider at base scope
7. First key in dns.providers (lowest priority)

SHC manages Traefik’s ACME configuration automatically:

• Generates certificate resolver configuration
• Injects DNS provider credentials for DNS-01
• Updates Traefik when provider configuration changes

• Sync is on-demand: only when providers change
• Only affected Traefik instances are updated
• All current providers are written on each sync

Configure contact email for Let’s Encrypt notifications:

acme:
  email: admin@example.com

For testing, use Let’s Encrypt staging:

acme:
  staging: true

1. Use DNS-01 for internal services: Avoids exposing port 80
2. Store credentials in Vault: Use ref+vault:// references
3. Set ACME email: Receive certificate expiration warnings
4. Test with staging first: Avoid rate limits during development