Domains

Attach a custom domain to a Cube

Attaches a domain and optionally configures any per-domain proxy settings at the same time. Settings can also be changed later via PATCH.

post/spaces/{spaceId}/cubes/{cubeId}/domains

Request

  • Base URL: https://krova.cloud/api/v1
  • URL: https://krova.cloud/api/v1/spaces/{spaceId}/cubes/{cubeId}/domains
  • Auth: API key in header X-API-KEY

Path parameters

spaceIdstring required
cubeIdstring required

Headers

Idempotency-Keystring

Optional unique key (max 255 chars). Replays return the original response and add header Idempotency-Replayed: true. Scoped per space; expires after 24h.

Request body

domainstring required

The hostname to attach, e.g. app.example.com

portinteger required

Cube port the domain proxies to.

securityHeadersMode'enforced' | 'app_managed'

enforced = proxy sets platform security headers (HSTS, X-Frame-Options, …); app_managed = the app's own headers pass through. Default enforced.

responseHeaderTimeoutSecsinteger

Seconds the app may take to send response headers (streaming unaffected). Default 60.

maxRequestBodyMbinteger nullable

Max request body size (MB). Null = unlimited (default).

originScheme'http' | 'https'

Scheme the edge speaks to the CUBE on the backend hop. http (default) = cleartext. https = the cube terminates TLS itself (a control panel holding its own certificate, or an app listening on HTTPS) and answers plain HTTP with a redirect, so it cannot be reached over cleartext at all. Visitors are on HTTPS either way. The dial port is derived: https on the default port 80 connects on 443; a deliberate custom port is honored exactly. Applied as saved: if the cube does not serve this hostname over HTTPS, requests to the domain fail until you set it back to http.

proxyProtocol'v1' | 'v2' nullable

Send a PROXY protocol header (v1 text or v2 binary) at the start of every connection to the cube, so the app reads the visitor's address from the connection itself, as on a plain VPS. Null (default) = off. The app must accept PROXY protocol on this port, or every request to the domain fails; it is applied as saved. Every domain on the same cube port must use the same setting: a save that would mix them is refused with 409 unless confirmMixedProxyProtocol is true.

confirmMixedProxyProtocolboolean

Accept a save that leaves domains on the same cube port with different proxyProtocol settings (for an app that handles both on one port, or mid-migration). Not stored.

responseCompressionboolean

Edge gzip/zstd compression. Default false (domains behind a CDN are already compressed there).

ipAllowListstring[] nullable

Visitor IP/CIDR allow-list (v4+v6). Non-empty ⇒ only these reach the app. Null/empty = open.

ipDenyListstring[] nullable

Visitor IP/CIDR deny-list (v4+v6) → 403. Null/empty = none.

basicAuthUserstring nullable

HTTP Basic Auth username. Null/empty clears Basic Auth. Setting it requires basicAuthPassword.

basicAuthPasswordstring

Plaintext Basic Auth password — bcrypt-hashed server-side, never stored or returned. Required when setting basicAuthUser.

Response

Domain attached

Changes

No recorded changes to this operation across all 1 revision of this API.