Custom Domains
Custom Domains will let an organization put its own domain — apps.example.com rather than a generated *.ci.computer hostname — in front of a paired Hub or an individual app, using Entri to write the DNS records and Cloudflare for SaaS to issue the certificate.
Custom Domains is not available yet. The backend flow is still in development and has not shipped: there is no user interface, and a domain cannot currently complete certificate issuance, so no custom domain can serve traffic. This page describes what is built so far and will be rewritten when the feature ships. Do not point a production domain at your organization.
How it is designed to work
The flow has three phases. Only the mechanics described here exist; everything else on this page is called out as missing.
Claim the domain
You tell the CI Account which domain you want and which hostname it should stand in front of. The domain is split into its apex and subdomain, checked against domains already claimed by other organizations, and recorded against your organization as pending.
A short-lived Entri token is issued at the same time so the browser can open Entri’s connect flow.
Set the DNS records
Entri detects your DNS provider and, where it can, writes the records for you after you authorize it; otherwise it shows you the records to add manually.
Finalize and monitor
Once Entri reports the records are in place, the CI Account registers the domain as a Cloudflare for SaaS custom hostname and switches on monitoring. Entri then sends signed webhooks as propagation status changes, and warns if the records are later removed or altered — recorded as drift on the domain, and cleared automatically when the records come back.
Once a domain is connected, the device’s tunnel configuration gains a matching ingress rule alongside the generated hostname it fronts, so traffic reaches the same app through the existing Cloudflare tunnel. No inbound ports are opened.
What is not available yet
These are not rough edges — each one blocks the feature end to end.
- No user interface. There is no Custom Domains screen anywhere in the CI Account. Nothing in the flow above can be reached by a person using the web app.
- Certificates cannot be issued. The domain-validation records that Cloudflare requires are not surfaced anywhere, so a custom domain cannot reach an active TLS state even if every other step succeeds.
- The records you need are never shown. The CI Account does not yet compute the target your domain should point at, so there is nothing to publish manually if Entri cannot write the records for you.
- Ownership is not verified. Nothing yet proves that the person connecting a domain controls it.
- Not billed or gated. The Custom Domains add-on exists in the billing catalog at $12.00 per month, but nothing checks it and there is no per-organization limit on the number of domains.
- No Hub-side integration. Custom domains are published in the device sync payload, but Companion Hub does not read them yet.
- Certificate status never updates. SSL status is set once and is not refreshed from Cloudflare, so it does not reflect reality.
Prerequisites (once it ships)
Recorded here so the shape of the feature is clear. None of this is actionable today.
- A CI Account with an organization, and a Hub paired to it
- The Cloudflare Gateway enabled on the device whose hostname the domain will front — custom domains ride the same tunnel
- A domain you control, with access to its DNS
- The Custom Domains billing add-on, once entitlement checks are in place
For developers
This surface is in an unmerged draft and will change. It is documented so the team can review the design, not for external use.
Custom domain endpoints require a signed-in session and membership of the organization named in the request. Entri’s webhook endpoint is unauthenticated but signature-verified.
| Method | Path | Purpose |
|---|---|---|
POST | /api/custom-domains/init | Claim a domain for an organization and mint an Entri connect token |
POST | /api/custom-domains/purchase/init | Mint an Entri token for buying a domain |
GET | /api/custom-domains | List an organization’s domains |
GET | /api/custom-domains/:id | Read one domain, including its status fields |
POST | /api/custom-domains/:id/finalize | Register the Cloudflare custom hostname and enable monitoring |
POST | /api/custom-domains/:id/recheck | Ask Entri to re-run propagation checks |
POST | /api/custom-domains/:id/check | Check a domain for conflicts before claiming it |
DELETE | /api/custom-domains/:id | Remove the domain, its Cloudflare hostname, and its monitor |
POST | /api/entri/token | Mint a scoped Entri token |
POST | /api/entri/webhooks | Receive signed Entri status events |
Each domain carries four independent status fields — propagation, redirection, SSL, and monitor — plus the timestamp of the last detected drift. Recheck is rate-limited to once every five minutes per domain and only works after Entri has supplied a job identifier.
Configuration
For whoever operates the CI Account deployment. Names only; never commit or paste the values.
| Name | Kind | Purpose |
|---|---|---|
ENTRI_SECRET | secret | Authenticates CI Account calls to the Entri API |
ENTRI_WEBHOOK_CLIENT_SECRET | secret | Verifies incoming Entri webhook signatures. Falls back to ENTRI_SECRET when unset. |
ENTRI_APPLICATION_ID | variable | Identifies this application to Entri |
ENTRI_API_BASE | variable | Entri API base URL |
ENTRI_WEBHOOK_ENFORCE_IP | variable | Whether to require webhooks to arrive from Entri’s published address |
CLOUDFLARE_SAAS_FALLBACK_ORIGIN | variable | The hostname customers point their domain at. Not read by any code yet. |
The Cloudflare credentials already used for the gateway are reused for custom hostnames, but the API token needs permission to manage SSL and certificates on the zone — a DNS-only token is not sufficient.
No ENTRI_* value is set in any environment today, and the deploy pipeline
does not sync them. Calls to Entri fail outright when ENTRI_SECRET is
missing rather than degrading gracefully.
Limits
- One organization can claim a given domain; a second organization is refused
- Recheck: once per five minutes per domain
- Monitoring reports drift on the DNS records only — it says nothing about whether the app behind the domain is healthy
What to use instead today
Until this ships, use the generated hostname your CI Account issues for each exposed app — see Cloudflare Gateway and Finding your app URL. If you want to run your own domain against a local Hub without the CI Account, see Linking a domain to your dashboard.
Watch the release notes for updates.