floo.app.toml. The next prod release creates the domain;
floo activates it automatically after you publish two DNS records.
Declare a domain
Add a block tofloo.app.toml:
service names the target service. It is optional for single-service apps and
required for multi-service apps. Product hosts getfloo.com and app.getfloo.com
are reserved and cannot be declared. Your plan’s custom-domain limits apply;
retired hosts do not count.
Release to prod
Commit and push the config, then wait for that commit’s dev deploy to go live. Promote it to prod:show again after that minute.
Configure DNS
Publish these two records at your DNS provider:
The certificate target is unique to the certificate. Copy it from your domain’s
output and keep both records in place for serving and certificate renewal.
Two apps may declare the same host. The first whose certificate issues wins:
the zone owner’s
_acme-challenge record determines which certificate can issue.
A verified host is refused to every other app.
Watch activation
floo checks every minute. Once the certificate has issued and the traffic record resolves to floo’s edge, the host serves and org admins receive one email.watch blocks until the domain is active or failed, or its timeout expires
(300 seconds by default). A timeout stops the command; floo keeps checking.
floo domains list --app my-app lists the app’s domains. The dashboard shows
domain status and DNS records as a read-only view.
Remove a domain
Delete its[domains."shop.example.com"] block and release to prod. Routes stop
on that release and the status becomes removed.
floo retains the certificate and DNS authorization for 7 days. Re-add the block
and release within that window to restore the host without new DNS work. After
7 days, floo deletes the retained resources; a later declaration needs a new
certificate record target.
A rollback or re-release of older config applies the same rule: a config without
the block retires the host. Restore by releasing config with the block within
the same 7-day window.
Apex domains
For an apex such asexample.com, replace the traffic CNAME with an ALIAS or
ANAME pointing to edge.getfloo.com, or an A record pointing to 34.117.26.37.
Use one of those traffic options. The certificate record remains a CNAME at
_acme-challenge.example.com with the target printed by floo.
Per-service custom domains
Declare a separate block for each host and name its service:[[routes]], each host routes directly to its assigned service. With explicit
routes, it serves the same complete route table as the app host. The app’s
access_mode applies on custom domains too. See
Multi-service routing.
Troubleshooting
Records not resolving
Compare your DNS records withfloo domains show shop.example.com --app my-app.
Check both names and targets, including the certificate target for this app.
Some DNS providers append the zone name automatically; avoid entering it twice.
Disable DNS proxying for these records. A proxied traffic record resolves to the
proxy instead of floo’s edge and prevents activation. Wait for your DNS
provider’s changes to propagate; floo checks again every minute.
Certificate failed
Read the failure message withfloo domains show shop.example.com --app my-app
and correct the _acme-challenge CNAME to point to the target printed for this
certificate. Fixing the record lets floo retry certificate issuance.
Still pending after 14 days
A host stillpending 14 days after the release may be claimed by another app.
Publishing both records at any time before then lets floo activate the host
automatically once the certificate issues and traffic DNS resolves to the edge.
Each prod release repeats Custom domain waiting on DNS with the records to
publish until the host activates.