> For the complete documentation index, see [llms.txt](https://docs.rumi.systems/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rumi.systems/rumi-cli/commands/cloud/civo/add-proxy.md).

# add-proxy

Expose a deployed service publicly through the bastion's nginx reverse proxy: traffic to `<service>.<domain>` is forwarded to the service's private address `<service>.rumi.local:<app-port>`. If the bastion has HTTPS enabled, the service is reachable at `https://<service>.<domain>`.

## Syntax

```bash
rumi cloud civo add-proxy \
  --api-key <token> \
  --region <region> \
  --network <network> \
  --keyPair <keypair> \
  --service <service> \
  --domain <domain> \
  --app-port <port> \
  [options]
```

## Options

| Option       | Short | Description                                                     | Default  |
| ------------ | ----- | --------------------------------------------------------------- | -------- |
| `--api-key`  | `-k`  | The Civo API token to use (or set `CIVO_API_TOKEN`)             | Required |
| `--region`   | `-r`  | The Civo region the network is in (e.g. `FRA1`)                 | Required |
| `--network`  | `-n`  | Name of the network                                             | Required |
| `--keyPair`  | `-K`  | The network SSH key pair                                        | Required |
| `--service`  | `-s`  | The service to expose                                           | Required |
| `--domain`   | `-d`  | The base domain; the service is exposed at `<service>.<domain>` | Required |
| `--app-port` | `-a`  | The service's app port to reverse-proxy to                      | Required |

## Example

```bash
rumi cloud civo add-proxy \
  --api-key $CIVO_API_TOKEN \
  --region FRA1 \
  --network my-cloud \
  --keyPair rumi \
  --service myapp \
  --domain example.com \
  --app-port 9000
```

## Notes

* **Public DNS is your responsibility, not Rumi's** — point `<service>.<domain>` (or a wildcard `*.<domain>`) at the bastion's public IP in whatever DNS hosts the domain. Rumi only writes the bastion's nginx entry.
* The service must be running and reachable on its app port.
* With HTTPS enabled the proxy terminates TLS on `:443`; otherwise it serves plain HTTP on `:80`.

## See Also

* [enable-https](/rumi-cli/commands/cloud/civo/enable-https.md)
* [launch-instance](/rumi-cli/commands/cloud/civo/launch-instance.md)
* [deploy](/rumi-cli/commands/cloud/civo/deploy.md)