Domains and TLS
Add the domain to a service, create the TXT and A/AAAA (or CNAME) records Unrent shows you, and wait for the checks to pass. The domain then goes live and gets a Let’s Encrypt certificate on its first visit.
Records to create
| Record | Why |
|---|---|
TXT _unrent-challenge.<name> = unrent-verify=<your organisation’s token> | Proves your organisation controls the name (for a www. name added with its apex, on the apex) |
A / AAAA to each of the service’s servers | Points traffic at the servers that run the service |
or CNAME to the service’s unrent.page address | An alternative for names that are not an apex |
Checks and states
A domain is pending until ownership, “points here” and CAA all pass, then verified, then active once each server has applied its routes. Checks run 1, 2 and 5 minutes after you add it, then every 15 minutes while pending and every 6 hours after; Check now runs them at once. A domain still pending after 7 days, or failing three re-checks in a row, becomes failed.
CAA records must allow letsencrypt.org (or not restrict issuers). Every A and AAAA answer must be one of the service’s servers: a stray AAAA record is a common cause of failures.
Behind Cloudflare
Set the record to DNS only until the domain is active, then turn the proxy back on with SSL/TLS mode Full (strict). Unrent detects a proxied record and tells you.
Default addresses
Every service also gets <service>-<env>-<id>.<server>.unrent.page, served with the server’s wildcard certificate. You do not need to configure anything.
Updated . This page as Markdown.