> ## Documentation Index
> Fetch the complete documentation index at: https://docs.boxd.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# HTTPS

> Every machine gets an HTTPS domain automatically.

Every machine gets a domain at `name.boxd.sh`. The boxd [proxy](/guides/proxies) terminates TLS and forwards HTTP requests to your machine.

```
https://myapp.boxd.sh  ->  your machine, port 8000 (default)
```

## Getting started

nginx is pre-installed and configured on port 8000, but disabled by default. Start it:

```bash theme={"theme":"github-dark"}
boxd machine exec myapp -- sudo systemctl start nginx
```

Visit `https://myapp.boxd.sh` to see a welcome page.

## Running your own app

Any process that listens on the proxy's target port (8000 by default) is reachable via HTTPS. No configuration needed.

```bash theme={"theme":"github-dark"}
# Python
boxd machine exec myapp -- python3 -m http.server 8000

# Go
boxd machine exec myapp -- "/home/boxd/app/server -port 8000"
```

## Changing the port

The default proxy forwards to port 8000, but you can change it:

```bash theme={"theme":"github-dark"}
# From outside
boxd machine proxy set-port --vm myapp --port 3000

# From inside the machine
boxd machine proxy set-port --port=3000

# Auto-detect the listening port
boxd machine proxy set-port --port=auto
```

## Subdomain proxies

Create additional subdomains pointing to different ports:

```bash theme={"theme":"github-dark"}
# api.myapp.boxd.sh -> port 3001
boxd machine proxy add api --vm myapp --port 3001

# List all proxies
boxd machine proxy list --vm myapp

# Remove a proxy
boxd machine proxy remove api --vm myapp
```

Each of these is a proxy, the same kind of object as the default one on port 8000. The [Proxies](/guides/proxies) guide covers them in full: creating and removing them, changing target ports, and how routing works.

## WebSockets

WebSocket connections work transparently. The proxy detects the `Upgrade: websocket` header and forwards the connection.

## Non-HTTP traffic

The HTTPS proxy speaks HTTP only: it terminates TLS and routes by domain. To reach a database, an SSH daemon, a game server, or any other raw protocol, expose a raw TCP/UDP port instead:

```bash theme={"theme":"github-dark"}
boxd machine proxy add --vm myapp --port 5432 --raw   # myapp.boxd.sh:<allocated-port> -> :5432 in the machine
```

See [Port forwarding](/guides/port-forwarding).

## HTTP to HTTPS

Plain HTTP requests to `http://name.boxd.sh` are redirected to HTTPS automatically. HSTS headers are included in the response.

## DNS

A DNS record is created automatically when your machine boots. The record has a 60-second TTL.

```
myapp.boxd.sh  ->  A record  ->  proxy's public IP
```

Every machine's domain points at the proxy's shared public IP. The proxy routes HTTPS by SNI (the domain in the TLS handshake) and SSH by the machine's dedicated port, so the same IP fronts every machine.

## Custom domains

Want your own domain instead of `name.boxd.sh`? See [Custom domains](/guides/custom-domains): per-machine, or a wildcard delegated to your whole org.