Deploy URL
Every project gets a `<project>.<organization>.runlot.app` address, and TLS is set up automatically.
Once a deploy completes, the project gets its default address.
my-app.me.runlot.appThe form is <project>.<organization>.runlot.app.
The older -- address is gone
Addresses used to join the project and the organization into a single label, as in my-app--me.runlot.app. That form is no longer registered. A deploy registers only the two-label name, and projects deployed before the change were moved over. If you shared the older address somewhere, update it — it no longer resolves.
Why the labels can be split
A wildcard certificate covers a single subdomain label, so one *.runlot.app certificate could not cover an address with two labels. runlot now issues a wildcard certificate per organization, *.<organization>.runlot.app, over ACME DNS-01 — Google Trust Services is the primary CA, with Let's Encrypt as the fallback. That is what lets the project and the organization each have their own label.
Naming rules
Organization slugs and project names must follow these rules.
^[a-z0-9](-?[a-z0-9])*$- 30 characters maximum (derived from the 63-character DNS label limit)
- A name may not contain two hyphens (
--)
The -- rule stays even though the default address no longer uses --. The direct PostgreSQL address still joins the two names with -- (my-app--me.wire.runlot.app), and without the rule project c in organization a--b and project b--c in organization a would share that address.
TLS
The TLS certificate for this address is managed automatically at the front. There is nothing to configure, and http:// requests are redirected to https://.
To connect a domain you own, see Custom domains.
Headers the worker receives
The front adds the current placement details to the request headers. These headers are useful when diagnosing a problem.
request.headers.get("Runlot-Project-Id");
request.headers.get("Runlot-Epoch");
request.headers.get("Runlot-Node");
request.headers.get("Runlot-Slot");Any runlot-* headers sent by the client are stripped at the front and re-added with trusted values. A client therefore cannot forge these header values.