Skip to main content

DNS & TLS Setup Runbook

Domain Requirements​

Yabanin requires 3 subdomains for production deployment (all with Caddy-managed TLS):

SubdomainPurposeServicePort
api.yourdomain.comGateway — OpenAI-compatible APIgateway8082 → Caddy → 443
admin.yourdomain.comAdmin panel & billing UIadmin8086 → Caddy → 443
dash.yourdomain.comCost dashboard (React SPA)dashboard-webnginx → Caddy → 443

DNS Records​

From your domain registrar, add three A-records pointing to the VPS IP:

Type   Name           Value        TTL
A      api            <VPS_IP>     300
A      admin          <VPS_IP>     300
A      dash           <VPS_IP>     300

Replace <VPS_IP> with your actual VPS public IP address.

TLS / SSL​

Caddy (via deploy/caddy/Caddyfile.tmpl) handles automatic HTTPS via Let's Encrypt. No manual certificate management needed — once DNS resolves, Caddy auto-provisions certs.

The gateway also receives its domains via environment variables:

  • API_DOMAIN → defaults to api.yourdomain.com
  • ADMIN_DOMAIN → defaults to admin.yourdomain.com
  • DASHBOARD_DOMAIN → defaults to dash.yourdomain.com

Override these by setting the env vars in .env (copied to deploy/secrets/env) before deploying:

# deploy/secrets/env
API_DOMAIN=api.example.com
ADMIN_DOMAIN=admin.example.com
DASHBOARD_DOMAIN=dash.example.com

Deploy Sequence​

  1. Purchase domain and note the IP address of your VPS
  2. Add DNS A-records (3 subdomains → VPS IP)
  3. Edit deploy/secrets/env with your actual domains
  4. Run deploy: ./scripts/deploy.sh
  5. Verify health checks — the script auto-checks all services
# After deploy, verify:
curl -sI https://api.yourdomain.com/v1/chat/completions | head -1
# Expected: HTTP/2 401 (unauthorized — API is up, no valid key)

Troubleshooting​

Caddy not getting certificates​

  • Ensure DNS records propagate (dig api.yourdomain.com)
  • Check Caddy logs: docker compose logs caddy
  • Verify port 80/443 are open on the VPS firewall
  • Let's Encrypt has rate limits — don't spam requests

Gateway can't reach domains​

  • Check gateway env vars in .env (API_DOMAIN, ADMIN_DOMAIN)
  • Confirm Caddyfile.tmpl domain blocks match your DNS records