HTTPS and domains

Every site gets an address of its own, https://name.localhost, with a certificate your browser trusts. You don't set up either one.

Addresses#

A site's name becomes its address: cove add shop answers at https://shop.localhost. Browsers already send any .localhost name to your own computer. Cove also writes each site, its extra domains and its own three addresses into /etc/hosts, so command-line tools find them too, and takes them out again when a site goes. Changing /etc/hosts needs your password, so Cove asks for it when it has to.

Cove's own addresses:

Not sure of a site's address, or where its files are?

cove url shop                  # https://shop.localhost, with the port if it isn't 443
cove path shop                 # the folder it serves

Certificates#

Caddy, the web server inside FrankenPHP, runs a small certificate authority on your computer and issues every site a certificate from it. Nothing leaves your machine. The installer adds that authority to your system's trust store and to your browsers, so there's no warning to click through.

If a browser does warn you, perhaps one you installed after Cove, run:

cove trust

It adds Cove's root certificate to the system trust store and to every browser certificate store it can find: Firefox profiles, the shared store Chrome, Chromium, Brave and Edge use on Linux, and snap and Flatpak browsers. Run it again any time; it's safe to repeat.

Phones and other computers don't trust it until you install the certificate there. See Sharing.

Ports#

Cove serves on the usual ports, 80 and 443. If another tool already has them, such as Local, Studio, DevKinsta or MAMP, Cove can run on other ports beside it. The installer offers 8090 and 8453 when it finds the ports taken, and you can change them later:

cove ports                               # a menu: keep, default or custom
cove ports --http=8090 --https=8453      # alternative ports
cove ports --http=80 --https=443         # back to the defaults
cove ports --dry-run                     # show what would change

On another HTTPS port a site's address carries it, https://shop.localhost:8453. Your sites move with the port:

• WordPress: Cove rewrites each site's stored URLs, for every domain the site answers on, with wp search-replace.
• Laravel: APP_URL follows, and VITE_REVERB_PORT for the front end's next build, unless APP_URL was set to another address.
• Plain sites need nothing.

Extra domains#

A site can answer on more than one name. Add a domain and the site serves it from the same folder, with a certificate of its own:

cove mappings shop                              # list them
cove mappings shop add shop.test
cove mappings shop add '*.shop.localhost'       # every subdomain
cove mappings shop remove shop.test

A leading *. answers on every subdomain; quote it so your shell leaves it alone. A domain can only belong to one site. In the dashboard, the same list is under a site's Domains… menu item.

Caddy rules for a site#

Need a header, basic auth or a reverse proxy on one site? Give it Caddy rules of its own. They go into the site's block of the Caddyfile.

cove directive add shop "header X-Robots-Tag noindex"
cove directive add shop --file rules.conf
cat rules.conf | cove directive add shop
cove directive add shop                  # opens an editor
cove directive list                      # every site's rules
cove directive delete shop

add and update both set the site's rules, replacing what it had. With no rules given, they open an editor in a terminal, or read the rules from a pipe.

Proxies#

To put HTTPS in front of something that isn't a site, use a standalone proxy. It gets a server block of its own:

cove proxy add opencode opencode.localhost 127.0.0.1:4096
cove proxy list
cove proxy delete opencode

The three arguments are a name for the entry, the domain to answer on, and where to send requests. Use a .localhost name, or one that already reaches this computer, such as its Tailscale name. Certificates come from Cove's authority unless you add --no-tls. Plain PHP shows the other way: a site whose only rule is a reverse proxy.

Reload#

cove reload

Writes the Caddyfile again from your sites, reloads Caddy without dropping a connection, and brings /etc/hosts up to date. Cove reloads on its own after anything that needs it, so you'll mostly want this after editing a site's files by hand, or when a site doesn't answer and you're not sure why.