HTTPS

Every machine gets a domain at name.boxd.sh. The boxd proxy terminates TLS and forwards HTTP requests to your machine.

https://myapp.boxd.sh  ->  your machine, port 8000 (default)

Getting started

nginx is pre-installed and configured on port 8000, but disabled by default. Start it:

boxd machine exec myapp -- sudo systemctl start nginx

Visit https://myapp.boxd.sh to see a welcome page.

Running your own app

Any process that listens on the proxy’s target port (8000 by default) is reachable via HTTPS. No configuration needed.

# Python
boxd machine exec myapp -- python3 -m http.server 8000

# Go
boxd machine exec myapp -- "/home/boxd/app/server -port 8000"

Changing the port

The default proxy forwards to port 8000, but you can change it:

# From outside
boxd machine proxy set-port --vm myapp --port 3000

# From inside the machine
boxd machine proxy set-port --port=3000

# Auto-detect the listening port
boxd machine proxy set-port --port=auto

Subdomain proxies

Create additional subdomains pointing to different ports:

# api.myapp.boxd.sh -> port 3001
boxd machine proxy add api --vm myapp --port 3001

# List all proxies
boxd machine proxy list --vm myapp

# Remove a proxy
boxd machine proxy remove api --vm myapp

Each of these is a proxy, the same kind of object as the default one on port 8000. The Proxies guide covers them in full: creating and removing them, changing target ports, and how routing works.

WebSockets

WebSocket connections work transparently. The proxy detects the Upgrade: websocket header and forwards the connection.

Non-HTTP traffic

The HTTPS proxy speaks HTTP only: it terminates TLS and routes by domain. To reach a database, an SSH daemon, a game server, or any other raw protocol, expose a raw TCP/UDP port instead:

boxd machine proxy add --vm myapp --port 5432 --raw   # myapp.boxd.sh:<allocated-port> -> :5432 in the machine

See Port forwarding.

HTTP to HTTPS

Plain HTTP requests to http://name.boxd.sh are redirected to HTTPS automatically. HSTS headers are included in the response.

DNS

A DNS record is created automatically when your machine boots. The record has a 60-second TTL.

myapp.boxd.sh  ->  A record  ->  proxy's public IP

Every machine’s domain points at the proxy’s shared public IP. The proxy routes HTTPS by SNI (the domain in the TLS handshake) and SSH by the machine’s dedicated port, so the same IP fronts every machine.

Custom domains

Want your own domain instead of name.boxd.sh? See Custom domains: per-machine, or a wildcard delegated to your whole org.

Getting started

Guides

Use cases

References

Getting started

Running your own app

Changing the port

Subdomain proxies

WebSockets

Non-HTTP traffic

HTTP to HTTPS

DNS

Custom domains

​Getting started

​Running your own app

​Changing the port

​Subdomain proxies

​WebSockets

​Non-HTTP traffic

​HTTP to HTTPS

​DNS

​Custom domains

Getting started

Running your own app

Changing the port

Subdomain proxies

WebSockets

Non-HTTP traffic

HTTP to HTTPS

DNS

Custom domains