Custom Domain Setup
Use your own domain with automatic HTTPS from Let's Encrypt. Decision factors, the four-step shape, and click-by-click setup for Cloudflare and Namecheap DNS.
Pair a domain you already own — like chat.example.com — with automatic HTTPS from Let’s Encrypt. Your server is reachable via your address, never appears in the Pulsar directory, and renews itself.
🤔 Is a custom domain the right path for me?
A custom domain is the standard way to give your server a permanent, friendly address with automatic HTTPS. It fits when:
- You already own a domain and want to keep using it.
- You’d rather not have your server listed in the Pulsar directory.
- You’re on an enterprise or self-hosted setup where DNS is non-negotiable.
If you can’t open port 443 or don’t have a domain, see Public Access for tunnel and reverse-proxy options.
⚠️ Is hosting right for your setup?
Making a server reachable from the internet only works, and only makes sense, when you control the network. Use a managed address instead if:
- You're on a network you don't own: public, cafe, hotel, dorm, office, or apartment-building / shared wifi. You can't safely change those routers, and opening them up isn't yours to do.
- You're behind CGNAT or your ISP blocks inbound ports. Direct hosting can't work no matter what you set.
- You'd rather not expose your home's public IP. A successful connection reveals it to whoever connects.
For any of these, let Orbitr Pulsar give your server a free, permanent address with no forwarding and your IP kept private, or route around it with a tunnel or reverse proxy: see Public Access.
What You’ll Need
- A running Orbitr server with the admin panel open
- A domain you own (e.g.
example.com) and access to its DNS - Access to your router (for port forwarding)
- The server’s public IP, shown in Admin Panel → Network Diagnostics
The Four-Step Shape
Regardless of provider, every BYO setup follows the same four steps:
- Point a DNS A record at your server’s public IP (e.g.
chat.example.com → 203.0.113.5). - Forward TCP 443 from your router to your server’s local IP. That’s the only port Orbitr needs — both regular HTTPS traffic and the Let’s Encrypt cert challenge ride on it.
- Save the domain in the admin panel — pick Auto TLS (Let’s Encrypt), enter email + domain, click Save & Provision Certificate.
- Wait 30–60 seconds. Orbitr verifies DNS, completes the TLS-ALPN-01 challenge on port 443, and hot-swaps the new cert into the running HTTPS server. Renewal is automatic from there.
⚠️ Port 443 won't work for me
CGNAT or an ISP that blocks inbound 443 makes direct hosting impossible — users can’t reach the app at all, regardless of certs. Skip to Public Access for Cloudflare Tunnel or a reverse-proxy setup.
Provider Walkthrough
Privacy: Opting Out of the Pulsar Directory
Pulsar discovery is opt-in. If you skip Pulsar registration entirely and connect over your own domain:
- Your server is not listed in the public Pulsar directory.
- No slug heartbeat is sent to Pulsar.
- No metadata about your server (name, IP, member counts) is published anywhere.
Friends connect by typing your domain into the Orbitr client directly. The only third parties that see traffic are the ones you’ve already chosen: your DNS provider for the lookup, and Let’s Encrypt during certificate issuance and renewal.
Renewal
Let’s Encrypt certificates last 90 days. Orbitr renews automatically:
- Daily background check at the cron interval.
- Renews when fewer than 30 days remain.
- Hot-swaps the new cert into the running HTTPS server — no restart, no dropped connections.
Watch status any time at Admin Panel → Security → TLS. The panel surfaces the issuer, expiry date, days remaining, and any last error from a failed renewal attempt. If renewal fails — DNS changed, Let’s Encrypt rate limit, port 443 stopped being reachable — a critical notification fires when fewer than 14 days remain.
Optional: Cloudflare Proxy After Issuance
After your certificate is working, you can turn on Cloudflare’s proxy (orange cloud) for DDoS protection and IP hiding. Edit your A record and toggle proxy ON.
⚠️ Warning
With the proxy on, the origin no longer terminates TLS for visitors — Cloudflare does. Let’s Encrypt’s TLS-ALPN-01 challenge talks to the origin’s TLS endpoint, so renewals fail. Either turn the proxy off temporarily for renewals (~every 60 days), or use Cloudflare Origin Server certificates instead (set Orbitr to TLS_MODE=custom and point at the origin cert files).
Dynamic IPs (When Your Public IP Changes)
Most home connections get a new public IP periodically. When it changes, your DNS record becomes stale and the cert renewal fails the next time around.
Cloudflare: set up a Cloudflare Dynamic DNS script (search “Cloudflare DDNS”) that hits the API to auto-update your A record. Or upgrade to a static IP from your ISP.
Namecheap: built-in Dynamic DNS support.
Enable DDNS in Namecheap
- Go to your domain’s Advanced DNS tab.
- Scroll to Dynamic DNS and toggle it ON.
- Note the Dynamic DNS Password shown.
Set Up a DDNS Client
Use a DDNS client like Inadyn or Namecheap’s own Dynamic DNS client .
Alternatively, ask your ISP for a static IP (sometimes free, sometimes ~$5/month).
Troubleshooting
DNS not resolving — propagation can take 5–30 minutes (sometimes longer). Verify with nslookup yourdomain.com or dnschecker.org. Make sure the record points to your public IP, not a LAN IP. With Cloudflare, ensure the proxy cloud is gray (DNS only) during issuance.
Port 443 blocked or unreachable — this is the real failure mode. Your ISP may block inbound 443, another app may already use it, or your OS firewall may block it. Check all three. Orbitr’s cert challenge (TLS-ALPN-01) runs entirely on 443, so a blocked port 80 has no effect — certificate issuance works even on residential networks where port 80 is blocked. If 443 is truly unreachable (common with CGNAT), see Public Access for the TLS_MODE=custom fallback.
Certificate failed — usually port 443 isn’t reachable from outside. Verify port forwarding and test from a different network (phone on mobile data).
Works locally but not from outside — hairpin NAT limitation on some routers (accessing your own public IP from inside your network). Test from a phone on mobile data; if it works there, the cert flow will work too.
CGNAT detected — the admin panel surfaces a CGNAT warning under Security (the TLS panel). Port forwarding can’t help. Use Public Access instead, or ask your ISP for a dedicated IP.
“Rate limited by Let’s Encrypt” — too many failed issuance attempts in a short window. The admin panel surfaces the exact retry-after timestamp; usually a few hours. Don’t keep clicking — the rate limit is per-domain.
Admin panel still says self-signed — refresh the panel. The HTTPS hot-swap doesn’t break the connection but the status banner only refetches every 30 seconds.
Related
- Public Access — tunnels, ngrok, and reverse proxy options when port 443 isn’t available
- IP Masking — hide your home IP from DNS
What's next?
Find Your IP and Make It StaticOrbitr PulsarOptional
Optional cloud identity backup and sync, so your identity follows you across devices.