enable-https

Put a real Let's Encrypt wildcard certificate on the network's bastion and make its nginx terminate TLS. The DNS-01 challenge is provider-pluggable — the deployment's public DNS can live wherever you keep it (Route 53, Hetzner DNS, Cloudflare).

Syntax

rumi cloud civo enable-https \
  --api-key <token> \
  --region <region> \
  --network <network> \
  --keyPair <keypair> \
  --domain <domain> \
  --dns-provider <route53|hetzner|cloudflare> \
  --dns-credentials <credential> \
  [options]

Options

Option	Short	Description	Default
--api-key	-k	The Civo API token to use (or set CIVO_API_TOKEN)	Required
--region	-r	The Civo region (e.g. FRA1)	Required
--network	-n	The name of the environment whose bastion to secure	Required
--keyPair	-K	The network SSH key pair	Required
--domain	-d	The base domain to secure; the wildcard cert covers <domain> and *.<domain>	Required
--dns-provider	-P	The DNS provider hosting the domain: route53, hetzner, or cloudflare	Required
--dns-credentials	-C	The provider credential for the DNS-01 challenge (format per provider, below)	Required
--email	-m	Let's Encrypt account email for expiry notices	none
--force	-f	Re-point a bastion already secured for a DIFFERENT domain	false

--dns-credentials format by provider

Provider	--dns-credentials value
route53	<accessKeyId>:<secretKey>[:region] (default region us-east-1)
hetzner	the Hetzner DNS API token
cloudflare	the Cloudflare API token

Example

# DNS for the domain lives in AWS Route 53
rumi cloud civo enable-https \
  --api-key $CIVO_API_TOKEN \
  --region FRA1 \
  --network my-cloud \
  --keyPair rumi \
  --domain rumi-https.n5corp.ai \
  --dns-provider route53 \
  --dns-credentials "AKIA...:wJalr...:us-east-1" \
  --email [e-mail]

Notes

• The bastion runs certbot certonly --<provider> for a wildcard DNS-01 cert; renewal is hands-free (a certbot-renew timer replays the challenge with the stored credential). The credential is written root-only on the bastion.

• Rumi does not manage public DNS. Pointing the public name at the bastion — e.g. *.<domain> or <service>.<domain> → the bastion's public IP — is your job, in whatever DNS hosts the domain. enable-https only proves control of the domain (the DNS-01 challenge) to issue the cert.

• Use a tightly-scoped credential: for Route 53, an IAM key limited to route53:ChangeResourceRecordSets/ListHostedZones/GetChange on that zone. It lives on the bastion for issuance and renewal.

• Run it after launch-bastion.

• A bastion secures exactly one domain. Re-running with the same domain is an idempotent renew; switching domains needs --force.

See Also

• launch-bastion

• deploy