Setting Up a Custom Domain

You can point your own domain to a container running on Bahriya. This guide walks through the steps to configure a custom domain with HTTPS.

Prerequisites

• A container deployed on Bahriya with at least one region active.
• A domain you control with access to its DNS settings (at your domain registrar or DNS provider).

Step 1: Add the domain to your container

In your container's networking section, add your domain — for example, app.example.com. You can attach up to 5 custom domains per container. The first is included; each additional domain is billed at $2.50/month, metered per minute (60-second minimum, rounded up).

Choose a DNS mode that determines how traffic is routed. Every mode uses CNAME records, and the console shows the exact target for your container:

Step 2: Create DNS records at your provider

Each custom domain needs two CNAME records: one that sends traffic to your container, and one that lets Bahriya prove it controls the domain so it can issue the TLS certificate.

app.example.com                  CNAME  <target shown in the console>
_acme-challenge.app.example.com  CNAME  _acme-challenge.<target shown in the console>

For example, for a container in one region:

app.example.com                  CNAME  mamluk-123.helsinki-1.x.on.bahriya.app
_acme-challenge.app.example.com  CNAME  _acme-challenge.mamluk-123.helsinki-1.x.on.bahriya.app

Copy both targets from your container's networking settings in the console; the DNS records preview there lists them for every hostname. The console can also check the _acme-challenge record for you once you have created it.

If using a root domain (apex)

Most DNS providers do not support CNAME records on root domains (example.com without a subdomain). Options:

• Use a subdomain instead (app.example.com, www.example.com).
• Use a DNS provider that supports CNAME flattening or ALIAS records (e.g. Cloudflare, DNSimple, Route 53).

Step 3: TLS certificate

Bahriya automatically provisions and renews a TLS certificate for your custom domain once both DNS records are in place. This typically takes a few minutes after the DNS change propagates.

You do not need to upload your own certificate or manage renewals.

Step 4: Verify

Once DNS propagation is complete (usually a few minutes, can take up to 48 hours depending on your DNS provider and TTL settings), visit your custom domain in a browser. You should see your application served over HTTPS.

WWW redirect

For any apex domain you add (e.g. example.com), you can enable WWW redirect on a per-domain basis. When enabled:

• Requests to www.example.com are redirected to example.com.
• The TLS certificate is automatically extended to cover the www variant alongside the apex.
• You need to create the DNS records for both example.com and www.example.com, including the _acme-challenge record for each.

The toggle is only available for apex entries — www.example.com or sub.example.com cannot opt in.

Troubleshooting

"Not secure" or certificate error:

• Check that the _acme-challenge record exists and points to the target shown in the console: dig CNAME _acme-challenge.app.example.com.
• DNS may not have propagated yet. Check with dig app.example.com or an online DNS checker.
• Wait a few minutes for the TLS certificate to be provisioned.

Site not loading:

• Verify that the CNAME record points to the target shown in the console for your container's DNS mode and regions.
• Check that the container is running and healthy in the Bahriya console.
• If using a CDN or proxy (e.g. Cloudflare), ensure it is not interfering with the certificate provisioning. You may need to temporarily disable proxying.