Use your own domain with HTTPS

Out of the box, a self-hosted suite already gets trusted HTTPS on its generated address, with nothing to buy. Two things that address cannot give you are what this guide is for: an address you chose, and a certificate that proves the server is yours rather than one shared by every server on the same private address. On http://home.mos.home/ there is no certificate at all, so apps that need a secure connection, password managers in particular, only work there once this is done.

This guide upgrades your suite to a real domain with a trusted certificate:

https://home.yourdomain.example/        ← your dashboard
https://seafile.yourdomain.example/     ← and every app

The remarkable part: your suite stays completely private. Nothing is exposed to the internet, no router ports are opened, and your domain never publicly points at your house. In plain terms, MOS proves to the certificate authority that you own the domain by briefly writing a note in the domain’s own DNS records — no public website required. (For the technically minded: it’s an ACME DNS-01 challenge, performed by Caddy through the Cloudflare API.)

What you need

• A home server (installed from the USB stick or over SSH). On a cloud server it is simpler: see On a cloud server.
• A domain name whose DNS is managed by Cloudflare (the free plan is fine). Cloudflare is the first supported provider; others may follow.
• A Cloudflare API token — created in the next step.
• The ability to add one local DNS rule on your network (same as in the install guide).

Set it up

1. Create the API token. In the Cloudflare dashboard: profile icon → My Profile → API Tokens → Create Token, use the Edit zone DNS template, and scope it to just your domain’s zone. The token needs Zone: Read and DNS: Edit — nothing more. Copy it; Cloudflare shows it only once.

2. Move your suite in Suite Manager. Open Settings → Suite address, choose Use your own domain, and fill in:

   • the Base domain — e.g. mos.yourdomain.example (a subdomain keeps the rest of your domain untouched; your dashboard becomes home.mos.yourdomain.example),
   • a Certificate contact email for the certificate authority (Let’s Encrypt),
   • the Cloudflare API token.

   Click Move my suite to this domain. MOS gets the certificate, reconfigures the web server and rebuilds your apps and Homepage on the new address, and reports success only once the domain is served. If a step fails, your suite stays where it was and Settings says why. The token is never shown again.

3. Add the local DNS rule. Until the name points at your server, Settings says so and shows your server’s IP and the exact rule to add: point home.<your-base-domain> (or better, the wildcard *.<your-base-domain>) at the server — in your router, AdGuard Home, Pi-hole, or as hosts-file lines on each computer. This is what makes the name resolve inside your network while staying invisible outside it.

4. Sign in on the new address. Open https://home.<your-base-domain>/ — padlock and all — and sign in again (moving to a new address ends the old session; that’s expected). Installed apps are re-routed to https://<app>.<your-base-domain>/ automatically, and their dashboard tiles update themselves.

Good to know

• The old addresses remain as recovery doors. If your local DNS rule ever breaks, the generated address and http://home.mos.home/ still reach Suite Manager so you can fix things.
• Certificates renew themselves. Caddy (the built-in web server) owns issuance and renewal; there is nothing to remember.
• Why Cloudflare specifically? The certificate flow needs API access to your DNS. MOS ships a web server custom-built with the Cloudflare DNS integration, version-pinned and verified at install time. Broader provider support is a roadmap item.
• Troubleshooting: give the first certificate a minute or two; if the new address doesn’t load, it’s almost always the local DNS rule (test with ping home.<your-base-domain> — it should answer with your server’s LAN IP). Your devices may also cache old DNS for a few minutes.

On a cloud server

A server at a hosting provider can be reached from the internet, so the certificate authority checks your domain simply by visiting it. You need no Cloudflare account and no token.

1. Type your domain. Open Settings → Suite address, choose Use your own domain, and enter it, e.g. yourdomain.example.

2. Add one DNS record where your domain’s DNS is managed, usually at the company you bought it from. Settings shows it filled in: an A record named *.yourdomain.example pointing at your server’s IP address. It covers your dashboard and every app.

3. Move your suite. Click Move my suite to this domain. A new record can take a few minutes to arrive, so MOS waits for it, checking every few seconds for up to half an hour and saying what it sees each time, and changes nothing until the record points at your server. You can cancel while it waits. Then each app gets its own certificate, and your apps and Homepage move to https://<app>.yourdomain.example/ one at a time, with Settings showing each one as it goes.