Custom Domains

Point your own domain at a service running on Tawa. The CLI handles DNS, TLS certificates, and ingress configuration automatically.

Add a Domain

tawa domain add mydomain.com

# Auto-configure DNS via InsurEco Cloudflare
tawa domain add mydomain.com --cloudflare

# Manual DNS — you'll add a CNAME yourself
tawa domain add mydomain.com --external

Option	Description
`--cloudflare`	Domain is on InsurEco Cloudflare — DNS auto-configured
`--external`	External DNS provider — you add the CNAME yourself
`--env <environment>`	Target environment: `prod` (default), `sandbox`, `uat`
`--service <name>`	Target service (default: detected from directory)

Cloudflare-Managed DNS

If the domain is on InsurEco's Cloudflare, everything is automatic:

tawa domain add portal.example.com --cloudflare

# ✓ DNS record created: portal.example.com → my-svc.tawa.insureco.io
# ✓ Domain registered in platform
# ✓ Domain is live at portal.example.com

A CNAME record is created and Cloudflare's Total TLS provisions a certificate automatically. The domain is live within seconds.

External DNS Provider

If you manage DNS elsewhere (GoDaddy, Route 53, etc.):

tawa domain add portal.example.com --external

# ℹ Please add a CNAME record at your DNS provider:
#     portal.example.com  →  my-svc.tawa.insureco.io
#
# ℹ After adding the record, run:
#   tawa domain verify portal.example.com

Add the CNAME at your provider, wait for propagation, then verify:

tawa domain verify portal.example.com
tawa deploy --prod   # apply ingress changes

DNS propagation can take up to 48 hours, though most providers complete within minutes.

Manage Domains

# Check DNS propagation status
tawa domain verify portal.example.com

# View full configuration details
tawa domain status portal.example.com

# List all custom domains
tawa domain list
tawa domain list --service my-svc

# Remove a domain
tawa domain remove portal.example.com

How It Works

When you add a custom domain, the platform:

Creates a CNAME record pointing to your service's platform hostname
Registers the domain in the service registry
Patches the Kubernetes ingress to accept traffic on the new hostname
Provisions a TLS certificate automatically (Cloudflare Total TLS or cert-manager)

On subsequent deploys, verified custom domains are automatically included in the Helm values.

Troubleshooting

Symptom	Cause	Fix
`domain verify` says "no CNAME record"	DNS not propagated yet	Wait and retry
Domain resolves but shows TLS error	Certificate not yet provisioned	Wait a few minutes
Domain resolves to wrong service	CNAME points to wrong hostname	Check `tawa domain status`
Domain works but stops after redeploy	Domain was not verified before deploy	Run `tawa domain verify` then redeploy

Last updated: February 28, 2026