reoclo domains

reoclo domains ls
reoclo domains add      <fqdn> [--app <app>] [--server <server>] [--port <n>]
                               [--redirect-to <target>] [--code <code>] [--no-keep-path]
                               [--allow <cidr>]... [--cloudflare]
reoclo domains access   <fqdnOrId> [--allow <cidr>]... [--cloudflare | --no-cloudflare] [--open | --inherit]
reoclo domains redirect <fqdnOrId> (--to <target> [--code <code>] [--no-keep-path] | --off)
reoclo domains verify   <fqdnOrId>
reoclo domains dns      <fqdnOrId> [--fix] [--proxied] [--yes]
reoclo domains publish  <fqdnOrId> [--proxied]

Domain commands cover registration, TXT-record verification, and the DNS records Reoclo expects. SSL issuance happens on the server. You can link a domain to an application with add --app, or in the dashboard. See Custom Domains.

`ls`

Lists every domain registered to the active tenant with its verification status, attached application (if any), and SSL state.

$ reoclo domains ls
FQDN              VERIFIED   ATTACHED        SSL      REDIRECT           ACCESS
api.example.com   yes        api             active   -                  cloudflare+2
docs.example.com  yes        docs            active   -                  inherit
www.example.com   yes        api             active   301 → example.com open
new.example.com   pending    -               -        -                  inherit

The ACCESS column shows which source IPs may reach the domain: inherit (the server’s default allowlist applies), open (everyone), or a summary of the domain’s own rules such as cloudflare+2 (the Cloudflare preset plus two custom ranges) or 3 CIDR. See access. - means the API did not report it.

`add <fqdn>`

Registers a new domain. The response includes the TXT record you need to add to your DNS provider before the domain can be verified.

If the FQDN is a verified root domain that is not linked to an application yet, the command links that existing record instead of creating a second one. The FQDN of a domain that is already linked is rejected.

$ reoclo domains add new.example.com
✓ registered new.example.com
  add this TXT record to verify ownership:
    name:  _reoclo-verify.new.example.com
    value: reoclo-verify=abc123def456

Flag	Meaning
`--app <app>`	Link the domain to this application (name, slug or id).
`--server <server>`	The server that serves the domain.
`--port <n>`	The container port to route to. Must be one of the application’s ports.
`--redirect-to <target>`	Link the domain as a redirect. `<target>` is a domain of the same application, with an optional path (`example.com/blog`), or a full URL (`https://example.org`). Needs `--app`.
`--code <code>`	Redirect status code: `301` (default), `302`, `307` or `308`.
`--no-keep-path`	Send every request to the target exactly. By default the request path and query are added to the target.
`--allow <cidr>`	Only allow this IP address or CIDR range. Repeat the flag for more than one (up to 100).
`--cloudflare`	Only allow Cloudflare’s published edge ranges. Can be combined with `--allow`.

$ reoclo domains add www.example.com --app web --redirect-to example.com
✓ added www.example.com (id: 019d..., status: active)
  redirects to example.com (301)

$ reoclo domains add api.example.com --app api --cloudflare --allow 203.0.113.0/24

Without --allow and --cloudflare, the domain inherits the server’s default allowlist. IP allowlists are enforced by the managed proxy, so the domain’s server must run it. Otherwise the API rejects the request with IP allowlists are enforced by the managed proxy. Enable it on <server> first.

The redirect flags need CLI 0.87.0 or newer. The allowlist flags need CLI 0.89.0 or newer.

`redirect <fqdnOrId>`

Changes an existing domain into a redirect, changes its target, or with --off makes it serve its application again. The flags are the same as for add: --to <target>, --code <code>, and --no-keep-path.

$ reoclo domains redirect www.example.com --to example.com --code 308
✓ www.example.com redirects: 308 → example.com

$ reoclo domains redirect www.example.com --off
✓ www.example.com serves its application again

You cannot change a domain into a redirect while other domains redirect to it. See Redirect www and other domains.

Needs CLI 0.87.0 or newer.

`access <fqdnOrId>`

Shows or changes which source IP addresses may reach a domain. The managed proxy enforces the rules, so the domain’s server must run it. Pass the domain by FQDN or id.

With no flags, the command prints the current access and changes nothing.

$ reoclo domains access api.example.com
api.example.com
access: cloudflare+1
  preset: cloudflare
  allow:  203.0.113.0/24

Flag	Meaning
`--allow <cidr>`	Allow this IP address or CIDR range. Repeat the flag for more than one (up to 100). Replaces the domain’s custom ranges. A bare address becomes a single-address range (`1.2.3.4` is stored as `1.2.3.4/32`).
`--cloudflare`	Allow Cloudflare’s published edge ranges. The platform keeps them current.
`--no-cloudflare`	Stop allowing Cloudflare’s edge ranges.
`--open`	Open the domain to everyone, even when the server’s default allowlist restricts.
`--inherit`	Remove the domain’s own rules and follow the server’s default allowlist again.

# Only Cloudflare and one office range
$ reoclo domains access api.example.com --cloudflare --allow 203.0.113.0/24
✓ api.example.com access: cloudflare+1

# Replace the custom ranges, keep the Cloudflare preset
$ reoclo domains access api.example.com --allow 198.51.100.0/24
✓ api.example.com access: cloudflare+1

# Keep the custom ranges, drop the Cloudflare preset
$ reoclo domains access api.example.com --no-cloudflare
✓ api.example.com access: 1 CIDR

# Follow the server default again
$ reoclo domains access api.example.com --inherit
✓ api.example.com access: inherit

The command reads the domain first and merges your flags into its current rules. --allow alone keeps the current preset, and --cloudflare or --no-cloudflare alone keeps the current custom ranges. A domain that inherits starts from an empty list.

There are three states, and they are not the same:

Inherit is the default. The server’s default allowlist applies, and if the server has none, everyone can reach the domain.
Own rules (--allow, --cloudflare) apply to this domain only and override the server default.
Open (--open) has no restrictions, even when the server default restricts.

--open and --inherit cannot be combined with each other or with --allow and --cloudflare. The command exits with 2 before sending a request. It also exits with 2 when a merge would leave no ranges at all, for example --no-cloudflare on a domain whose only rule is the Cloudflare preset. An empty allowlist opens the domain to everyone, so use --open when that is what you want.

If the domain’s server does not run the managed proxy, the API rejects the change with IP allowlists are enforced by the managed proxy. Enable it on <server> first. To set a default for every domain on a server, see reoclo proxy allowlist.

With -o json or -o yaml, the command prints the updated domain, or fqdn and ip_allowlist when it only shows the current access.

Needs CLI 0.89.0 or newer.

`verify <fqdnOrId>`

Triggers a verification check. Run this after the TXT record has propagated. Returns verified once the record is found, or the same TXT record details if it is not yet visible.

reoclo domains verify new.example.com
reoclo domains verify 019dc1a8-841f-7102-ac5d-3ee9e9353795

DNS propagation can take anywhere from a few seconds to several hours depending on your provider’s TTL.

`dns <fqdnOrId>`

Shows the records Reoclo expects for the domain, what public DNS answers, and the status of each record.

$ reoclo domains dns app.example.com
TYPE  NAME             EXPECTED     OBSERVED      STATUS
A     app.example.com  203.0.113.7  198.51.100.1  mismatch

Status: misconfigured

With --fix, the command reads the zone on Cloudflare and shows the changes it would make. It asks for confirmation, then writes the records and waits for the result. This needs a Cloudflare DNS provider that covers the zone. See Let Reoclo write the records.

Flag	Meaning
`--fix`	Preview the changes, then write them after confirmation.
`--proxied`	Proxy new records through Cloudflare (orange cloud). Updates keep their proxy state.
`--yes`	Skip the confirmation prompt.

$ reoclo domains dns app.example.com --fix
ACTION  TYPE  NAME             CURRENT       NEW
update  A     app.example.com  198.51.100.1  203.0.113.7
Apply these changes on Cloudflare? [y/N]: y
✓ published: A app.example.com -> 203.0.113.7 (updated)

Needs CLI 0.83.0 or newer.

`publish <fqdnOrId>`

Writes the domain’s DNS records to Cloudflare in one step. If publishing is not enabled for the domain yet, the command enables it, then plans the changes and publishes them. It waits for the publish to finish. Unlike dns --fix, it does not ask for confirmation. This needs a Cloudflare DNS provider that covers the zone. See Let Reoclo write the records.

Flag	Meaning
`--proxied`	Proxy new records through Cloudflare (orange cloud).

$ reoclo domains publish app.example.com --proxied
ACTION  TYPE  NAME             CURRENT       NEW
update  A     app.example.com  198.51.100.1  203.0.113.7
✓ published: A app.example.com -> 203.0.113.7 (updated)

When Cloudflare already matches the expected records, the command changes nothing and reports unchanged:

$ reoclo domains publish app.example.com
Every expected record is already correct.

The command exits with 1 when the plan is blocked (for example, the domain has no expected origin yet), when the publish fails, or when the publish is still running after the wait. A failed publish lists the records applied before the failure on stderr. Run reoclo domains dns to see the current state.

With -o json or -o yaml, the command prints the result: status (published, unchanged, blocked, failed, or timeout), the plan, the applied records, and the error, if any.

Exit codes

Code	Meaning
0	Success (or domain already verified, or `publish` found nothing to change)
1	Server-side error, or `publish` was blocked, failed, or timed out
2	Wrong flags, for example —code without —redirect-to, or —open with —inherit
3	Authentication failure
5	Domain not found
7	Control plane unreachable: DNS, connection refused, or timeout (CLI 0.55.0+, earlier versions report 1)

Custom Domains guide: full DNS, attachment, and SSL workflow

reoclo domains

ls

add <fqdn>

redirect <fqdnOrId>

access <fqdnOrId>

verify <fqdnOrId>

dns <fqdnOrId>

publish <fqdnOrId>