Skip to content
xPort

Custom domains (BYOD)

On Pro and Team plans you can serve shares from your own domain — https://share.acme.com instead of https://<name>.xport.sh.

Exact domains

Section titled “Exact domains”

  1. Add the domain in the dashboard (Custom domains) — e.g. share.acme.com.

  2. Point a CNAME at the service host at your DNS provider:

    Type Name Value
    CNAME share.acme.com xport.sh

  3. Check DNS in the dashboard. Once the CNAME resolves, the domain is verified and the TLS certificate is issued automatically (Let’s Encrypt HTTP-01; allow a minute).

  4. Share with your domain:

    Terminal window
    xport 3000 --domain share.acme.com

Wildcard domains

Section titled “Wildcard domains”

Add *.acme.com once and claim any subdomain per share — one verification, one wildcard certificate, unlimited URLs:

  1. Add the wildcard in the dashboard: *.acme.com.

  2. Create the TXT record at your DNS provider (the dashboard shows the exact name and value):

    Type Name Value
    TXT _xport-verify.acme.com <your token>

    TXT control proves you can answer DNS-01 challenges — which is what certificate issuance needs.

  3. Check DNS in the dashboard. Verified wildcards get a *.acme.com certificate via Let’s Encrypt DNS-01 (Cloudflare).

  4. Claim subdomains freely:

    Terminal window
    xport 3000 --domain demo.acme.com
    xport 3000 --domain review-42.acme.com

Single-level claims (demo.acme.com) ride the wildcard certificate. Multi-level claims (foo.bar.acme.com) get their own per-host DNS-01 certificate automatically — wildcard certificates only span one level, so we issue the exact host. Certificates appear within a minute or two of the first claim.

The relay verifies at register time that the signed-in account owns the exact domain or a wildcard covering it, serves the session on the exact host, and advertises the custom URL. Only one active share can use a host at a time; a wildcard counts as one reserved domain no matter how many subdomains you claim.

How it works

Section titled “How it works”
dashboard verify (CNAME or TXT token) → relay polls /internal/domains
→ cert planner (exact: HTTP-01, wildcard + multi-level: DNS-01)
→ CLI --domain → exact-host routing
  • Ownership lives in the account database; the relay polls the verified-domain list (domains.url, cached ~60 s) and matches exact domains first, then wildcard suffixes at any depth.
  • php artisan xport:certs (cron) plans the edge certificate set from the dashboard domains plus the relay’s live claims (GET /internal/v1/claims), issues missing certificates via certbot, drops stale ones, and regenerates the nginx config. --dry-run prints the plan.
  • Custom domains always require xport login; anonymous shares use xport.sh hostnames.

Self-hosting

Section titled “Self-hosting”

Set domains.url on your relay to your account server’s /internal/domains endpoint (bearer: internal.token) and run xport:certs against your own database and DNS credentials. Without it, --domain registrations are rejected with a clear message. DNS-01 issuance uses the certbot Cloudflare plugin (cloudflare_credentials in config/xport.php).