For the complete documentation index, see llms.txt. This page is also available as Markdown.

enable-https

Put a real Let's Encrypt wildcard certificate on the network's bastion and make its nginx terminate TLS. The DNS-01 challenge is provider-pluggable — the deployment's public DNS can live wherever you keep it (Route 53, Hetzner DNS, Cloudflare).

Syntax

rumi cloud civo enable-https \
  --api-key <token> \
  --region <region> \
  --network <network> \
  --keyPair <keypair> \
  --domain <domain> \
  --dns-provider <route53|hetzner|cloudflare> \
  --dns-credentials <credential> \
  [options]

Options

Option
Short
Description
Default

--api-key

-k

The Civo API token to use (or set CIVO_API_TOKEN)

Required

--region

-r

The Civo region (e.g. FRA1)

Required

--network

-n

The name of the environment whose bastion to secure

Required

--keyPair

-K

The network SSH key pair

Required

--domain

-d

The base domain to secure; the wildcard cert covers <domain> and *.<domain>

Required

--dns-provider

-P

The DNS provider hosting the domain: route53, hetzner, or cloudflare

Required

--dns-credentials

-C

The provider credential for the DNS-01 challenge (format per provider, below)

Required

--email

-m

Let's Encrypt account email for expiry notices

none

--force

-f

Re-point a bastion already secured for a DIFFERENT domain

false

--dns-credentials format by provider

Provider

--dns-credentials value

route53

<accessKeyId>:<secretKey>[:region] (default region us-east-1)

hetzner

the Hetzner DNS API token

cloudflare

the Cloudflare API token

Example

Notes

  • The bastion runs certbot certonly --<provider> for a wildcard DNS-01 cert; renewal is hands-free (a certbot-renew timer replays the challenge with the stored credential). The credential is written root-only on the bastion.

  • Rumi does not manage public DNS. Pointing the public name at the bastion — e.g. *.<domain> or <service>.<domain> → the bastion's public IP — is your job, in whatever DNS hosts the domain. enable-https only proves control of the domain (the DNS-01 challenge) to issue the cert.

  • Use a tightly-scoped credential: for Route 53, an IAM key limited to route53:ChangeResourceRecordSets/ListHostedZones/GetChange on that zone. It lives on the bastion for issuance and renewal.

  • Run it after launch-bastion.

  • A bastion secures exactly one domain. Re-running with the same domain is an idempotent renew; switching domains needs --force.

See Also

Last updated