Reachability

A Recued server is fully functional on your own network. Public reachability is needed only by features that receive inbound traffic. When you do publish a name, it points directly at your server — the cloud publishes the name and can issue the certificate, but it is not in the traffic path and cannot decrypt what flows to you.

#What needs inbound reachability

Outbound-only integrations need none of this: IMAP mail sync, API polling, and Salesforce's streaming subscription are all connections your server opens outward. A vendor that can only push webhooks falls back to periodic reconciliation when your server has no public URL.

#Two questions, not one list

Getting a public name is really two decisions, and they are independent:

1. Which name? A domain you already own, or a <handle>.recued.net name Recued gives you.
2. Who keeps the certificate current? You, or Recued.

Pro changes only the second answer. Your own domain works either way — that is the part worth being clear about, because the upkeep differs a lot.

Everything except the Pro rows is free forever, and Pro gates no capability — your traffic goes straight to your server on every row.

The middle row is the one that used to make paying customers worse off: bring your own domain and you were back to a certificate chore every ninety days, while the recued.net name renewed itself. Pro now covers your own domain on the same terms.

#How the name and certificate work

Most home and small-VPS addresses change over time. Dynamic DNS solves that: your server keeps its own name record pointed at its current address, so the name always resolves — directly to your server, with no proxy in between. The certificate that makes the name trustworthy is issued through an ACME DNS challenge; the private key is generated and kept on your server. What the cloud handles is the name record and the challenge — it sees your hostname and public IP, and none of your traffic. Running it yourself is the same mechanics with your own domain, DNS, and certificate tooling.

#Your own domain, without Pro

Point the name at your server and handle TLS yourself. Two shapes:

Terminate TLS in front of Recued. A reverse proxy, Caddy, or anything else that holds the certificate and forwards to your server. Recued never sees a certificate; your proxy renews on its own schedule. Register the hostname in Settings → Server → Hostnames as Handled outside Recued so the server knows the name is yours and expects TLS to arrive already terminated.

Upload the certificate to Recued. Obtain one however you like — certbot, your registrar, your employer's PKI — and upload it in Settings → Server → TLS Certificates. Recued serves it per hostname.

⚠ An uploaded certificate is not renewed for you. Recued has no way to obtain a new one on your behalf, so it serves what you gave it until it expires and warns you as that approaches. Plan on re-uploading roughly every ninety days, or use one of the other two paths.

#Your own domain, with Pro

Recued issues and renews the certificate for a domain you own. Two DNS records, created once. The second is the one that does the work.

The first record makes your domain reach your server. The second lets Recued prove it may issue certificates for that name.

You need both, and the failure when you have only the first is the confusing one: your domain resolves, your server answers, and no certificate can ever be issued. Certificates are validated against _acme-challenge.your-domain.com — a different name, in a zone Recued cannot write to. The second record points that name at a zone Recued can write to, and the certificate authority follows it.

Settings → Server → Hostnames fills both records in with your own handle, checks them live, and tells you which one is wrong.

#Three things that catch people out

Names are relative. Most DNS providers want the name relative to your zone, so enter _acme-challenge.recued, not the full _acme-challenge.recued.your-domain.com. Pasting the full name usually produces _acme-challenge.recued.your-domain.com.your-domain.com without any complaint — the record looks created and resolves nowhere.

Proxying hides the record. If your provider can proxy a record — the orange cloud in Cloudflare — the _acme-challenge one must be set to "DNS only". A proxied CNAME is answered with the provider's own addresses instead, so the certificate authority cannot follow it. Cloudflare proxies by default, so this is the common case rather than an exotic one.

A root domain needs ALIAS or flattening. DNS does not allow a CNAME at the root of a zone. Use your provider's ALIAS, ANAME, or CNAME-flattening option for the routing record — Cloudflare, Route 53, DNSimple, and deSEC all have one. A subdomain such as recued.your-domain.com avoids the question entirely and works everywhere.

A trailing dot on a value is fine either way; providers differ and both spellings are accepted.

#Leave the _acme-challenge record in place

It is not a one-time step. Every renewal uses it, so deleting it breaks nothing today and everything about sixty days from now, when the certificate expires.

Recued re-checks the record on a schedule rather than waiting for a renewal to fail, and flags the hostname as soon as it stops resolving — quietly when there is plenty of certificate left, and urgently as expiry approaches.

#Limits

Up to five custom domains per server, and this one is Pro: it uses Recued's certificate-issuing capacity on your behalf. Each domain gets its own certificate rather than sharing one, so a mistake in your zone can never affect your <handle>.recued.net name — which is the address you would need in order to come back and fix it.

If your CAA records restrict which authorities may issue for your domain, add all of sectigo.com, pki.goog, and letsencrypt.org. Recued rotates between them, and permitting only some produces a certificate that renews most of the time — the worst kind of failure to diagnose.

#Use HTTPS

Browsers restrict the cryptography that pairing and the webclient depend on to secure contexts: HTTPS, or plain HTTP on a loopback address. That is why the boot log prints http://127.0.0.1:<port>/webclient/ — on the server machine itself, that address needs no certificate and works offline.

#Reaching the webclient from another device

Your server answers on every interface, so http://192.168.1.x:<port>/webclient/ loads from a phone or laptop on the same network. The page appears; the app then stops with a message instead of pairing. Nothing is broken — a plain-HTTP address on a LAN IP is not a secure context, so the browser withholds the Web Crypto APIs pairing needs, and Recued says so rather than failing obscurely.

Two ways forward:

Put HTTPS in front. Any TLS termination works: a reverse proxy with a certificate, a private-network service that provides one, or a name and certificate as described above. This is the durable answer, and it is the only one that scales past a single device.

Opt one browser in. Chromium browsers can treat a specific origin as secure: open chrome://flags/#unsafely-treat-insecure-origin-as-secure, add the exact origin (http://192.168.1.121:7718, matching host and port), and restart the browser. This is per-device and per-browser, and it relaxes a protection that applies to that origin generally — reasonable on a home network you control, not something to hand to other people.

#Choose which address the server binds

By default the server detects your network interface, binds every interface, and stays reachable on both loopback and your LAN address. On a machine with several candidate interfaces — a container bridge or a VM network alongside the real one — it follows your default route to decide which address to publish.

To pin it, set network.lan_bind_address in config.toml and restart:

[runtime]
"network.lan_bind_address" = "192.168.1.121"

The value is bound exactly as written, so it also narrows what the server answers on: 127.0.0.1 serves only the server machine, and 0.0.0.0 serves everything. If the address is not one this machine has, the server logs the reason at boot and falls back to detection rather than refusing to start.

#Next

Pick a release channel in Updates.