Hostnames & routing

Operator reference for public hostnames and gateway routing. Canonical repo copy: docs/DOMAINS.md.

Naming model

Isoward is the product. One control-plane origin; service hosts are separate:

isoward.com: canonical gateway (marketing, dashboard, API, webhooks, OAuth callbacks)
{serviceId}.isoward.com: customer deploy URLs (one subdomain label for free TLS)
cloud.isoward.com: temporary 301 alias for bookmarks; /v1/auth/* and /webhook/* return 410 (use apex URLs)

Production routes the apex and service wildcard through the Cloudflare tunnel to one gateway. OAuth and webhooks use ISOWARD_PUBLIC_URL (https://isoward.com). Auth cookies default to Domain=.isoward.com; set ISOWARD_HOST_ONLY_AUTH_COOKIES=1 for apex host-only sessions.

Public hostnames

Hostname	Purpose
`isoward.com` / `www`	Control plane: marketing, dashboard, `/v1`, webhooks, OAuth
`{serviceId}.isoward.com`	Per-service default URLs
`cloud.isoward.com`	301 → apex for bookmarks; 410 for `/v1/auth` and `/webhook`
`api.breachfix.com`	Operator billing API (separate product; optional for Isoward Cloud)

Legacy cloud.breachfix.com and {serviceId}.breachfix.com redirect to Isoward hostnames after cutover.

Why service URLs use one label under `isoward.com`

Cloudflare Universal SSL (free) covers isoward.com and *.isoward.com, including srv-xxx.isoward.com. It does not cover second-level names like srv-xxx.cloud.isoward.com without a paid Advanced Certificate (~$10/mo). Default deploy URLs therefore use {serviceId}.isoward.com.

Alternate TLDs (`.dev`, `.io`)

isoward.dev and isoward.io are registered for trademark and typo protection. Phase 1: both 301 redirect to isoward.com (configured by scripts/setup-isoward-cloudflare.sh). No application routes to them today. Future: isoward.dev may host docs or staging.

Environment variables

.env

ISOWARD_PUBLIC_URL=https://isoward.com
ISOWARD_PUBLIC_DOMAIN=isoward.com
ISOWARD_SERVICE_DOMAIN=isoward.com
ISOWARD_EDGE_NETWORK=isoward-net
# Legacy aliases (still read during migration):
BREACHFIX_CLOUD_PUBLIC_URL=https://isoward.com
BREACHFIX_CLOUD_PUBLIC_DOMAIN=isoward.com
BREACHFIX_CLOUD_SERVICE_DOMAIN=isoward.com

Per-service routing

Traffic arrives on srv-*.isoward.com via Cloudflare tunnel wildcard
Gateway resolves hostname → service ID
Reverse-proxy to live container lc-{serviceId} on PORT (default 8080)

Gateway proxy is the active path; Traefik labels are reserved for a future edge option.

User-facing guide: Default service URLs.