Domains & SSL

1. Two kinds of domain

The whole tab behaves differently depending on which of these you are looking at, so it is worth separating them first.

An application normally gets its SharkCluster subdomain automatically at creation. Adding a second one is blocked:

The manual add exists for applications that skipped the automatic step — a Git or ZIP deployment, which intentionally does not create the vhost and DNS.

2. The header

Both actions are hidden — not just disabled — for a team member without the permission on that server.

3. The domain list

Empty list: No Data Available.

The list refreshes itself

The list re-fetches every 20 seconds while the tab is open. That is deliberate: a Cloudflare custom hostname can take from a few minutes to a couple of hours to finish validating, and the badge updates on its own rather than requiring you to reload.

When a domain finishes activating, you get a toast even if you closed the setup dialog long ago:

Cloudflare column — three states, not two

Pending is the state people misread. Requesting Cloudflare is not the same as Cloudflare being live; until the badge turns green, traffic is not being served through it.

Clicking the cell on a primary domain with Cloudflare requested opens the Cloudflare Protection page for that domain.

URL Status — the most useful column on the page

Four independent checks per domain, laid out as a small grid:

non-www   HTTP ✓   HTTPS ✓
www       HTTP ✓   HTTPS ✗

Hovering shows the actual status code or error.

Two details that matter:

• A redirect counts as healthy. The check does not follow redirects, so a 301 from non-www to www reports as its own status and is treated as working — which is exactly what a correctly configured redirect should look like.
• This is re-checked on every list fetch, unlike DNS and Cloudflare status, which stop being polled once they are good. A site that worked yesterday can be down today, so this column never stops looking.

This column tells you at a glance which of the four variants a visitor can actually reach, which is usually the real question behind "why doesn't my domain work".

About the Expiry Date column

This is one year from when the domain record was added in SharkCluster. It is not your registrar's renewal date and not the SSL certificate's expiry — Let's Encrypt certificates renew automatically and Cloudflare manages its own. Read it as a record date, not a deadline.

4. Adding a domain

ADD DOMAIN opens a form whose fields change as you type.

Domain Name

e.g. yourdomain.com

Typing here decides what the rest of the form offers:

• A *.sharkcluster.com name when one already exists → blocked.
• An apex domain — exactly two labels, like example.com — cannot use Cloudflare. The form says so: > Cloudflare isn't available for example.com on its own. Use > www.example.com* instead to enable Cloudflare.* The reason is DNS, not policy: the Cloudflare custom hostname flow needs a CNAME, and most DNS providers do not allow a CNAME at the zone apex. If you want Cloudflare, add www.example.com and let the apex redirect to it.

Auto Redirect

Pick one and stay with it. Serving the same site on both hostnames without a redirect splits your traffic across two addresses and duplicates them for search engines.

This choice also changes what the DNS panel asks you for — see below.

Primary Domain

The application's canonical address. Turning it on when another domain is already primary opens a confirmation:

The primary domain is what the application's own base URL is set to. Making a domain primary rewrites the application's virtual host URL (and its database manager URL) to match. The old primary is demoted and its SSL flags are cleared.

Auto SSL

Requests a Let's Encrypt certificate for the domain.

A new primary domain inherits SSL settings from the current primary — if the existing primary has Auto SSL on, the new one gets it too.

Cloudflare

Offered for custom subdomains only, as a priced add-on:

The card shows the list price struck through and the current offer — a free trial period when one is configured, otherwise the per-domain monthly price, in your local currency.

Enabling it does three things: registers a Cloudflare custom hostname, creates the billing records for the add-on, and changes how SSL is handled — see section 8.

Copy Primary Virtual Host

Appears only when a primary domain already exists and you are making this new domain primary.

Confirmation names both sides explicitly, and notes that the virtual host configuration (rewrites, PHP settings, custom rules) will be copied from the primary domain and adapted for the new domain.

Use this whenever your current primary has hand-edited vhost rules. Without it the new domain gets a freshly generated default vhost, and any custom rewrite, PHP setting or security rule you added by hand is simply not there — the site loads and behaves subtly differently.

DNS Setup Required

When you are adding a custom domain with Cloudflare, the form shows the exact records to create, with copy buttons on each value:

Why two records in that second case: Cloudflare's custom hostname covers only the exact www. hostname. The bare apex is not proxied by Cloudflare at all, so it needs its own A record straight to the server — which is what lets the server receive apex traffic and redirect it to the www address. Both are required; it is not an either/or.

Your existing SharkCluster subdomain keeps working throughout.

The confirmation gate

SAVE stays disabled until you tick:

Hovering the disabled button explains why: Please confirm you have added the DNS record.

This is not bureaucracy. Cloudflare cannot validate a hostname whose DNS does not point at it, so saving first and adding records later means the domain sits in Pending until you go back and do it.

5. The setup instructions that appear after saving

For a custom domain with Cloudflare, saving opens Domain Setup Instructions — a numbered checklist that stays useful after the dialog closes, because the same records are shown in the edit dialog.

At the top, a live status banner, re-checked every 15 seconds:

turning into:

The steps:

1. Add DNS records at your domain provider — the CNAME, plus the apex A record in the two-record case, plus an A-record alternative where a CNAME at the root is not supported.

2. Add the DCV Delegation TXT record for SSL — it authorizes Cloudflare to verify domain ownership on your behalf, which is what makes certificates issue and renew without you. If Cloudflare has not produced the records yet the step shows as pending: DCV records are being provisioned by Cloudflare. Check back in a few minutes.

3. Keep your old SharkCluster subdomain active for now — marked Required:

4. Update your app's own base URL — also Required, and tailored to the technology, because pointing the vhost at a new domain does not change what the application thinks its own address is:

Skipping this step is the classic cause of a site that loads on the new domain but generates links, assets and redirects pointing at the old one.

6. Editing a domain

The pencil icon opens Edit Domain with the same fields, plus a few differences:

• Auto SSL is only available on the primary domain. On any other domain, the toggle is disabled and labelled Only for primary.
• Cloudflare Integration is a plain toggle here. Turning it off removes the Cloudflare custom hostname for that domain.
• The DNS panel only appears for a custom domain that is not yet registered with Cloudflare. Once the hostname exists, you are past that step and the panel does not reappear.
• Renaming a domain that has a Cloudflare hostname deletes the old hostname and registers a new one — so the domain returns to Pending and needs its DNS records to match the new name.

Changing the primary domain from here raises the same confirmation, noting that SSL settings will be transferred to the new primary domain.

7. Deleting a domain

The delete icon is greyed out on the primary domain — its tooltip reads Cannot delete primary domain — and the server refuses it as well:

For any other domain, confirmation is Are you sure you want to delete this domain?

Deleting removes the virtual host from the server and cleans up the Cloudflare side — the DNS record for a SharkCluster subdomain, or the custom hostname for a custom domain.

8. Bulk Actions

Select domains with the checkboxes (the header checkbox selects all), then Bulk Actions:

Each action shows a warning naming what it will change, and APPLY runs it.

9. Virtual Host Config

The eye icon on any row opens the raw web server configuration for that domain — the actual file on the server, with its path shown in the header.

• The full nginx or Apache config in an editor
• TEST & SAVE CHANGES — the label is literal: the configuration is tested before it is applied, so a syntax error is rejected rather than taking your web server down. On failure, the exact server output is shown in a red block below.
• CLOSE — discards.

Succesas: Virtual Host updated successfully!

This is the escape hatch for anything the form does not cover — custom rewrites, proxy rules, header settings, per-domain PHP values.

10. What happens on the server

Adding or updating a primary domain does real work over SSH:

1. 1A virtual host file is written for the domain — nginx or Apache, matching the server's web server, with the document root resolved for the technology (Laravel, Magento's pub, WordPress, OJS all differ).
2. 2The redirect you chose is configured between the www and non-www forms.
3. 3SSL is arranged, and this depends on Cloudflare:

1. 1A certbot fallback: Let's Encrypt validates every name in the request and fails the whole thing if any one of them does not resolve. If the www or alias record is not pointed yet, the request is retried with the canonical name alone, so you still get a certificate. In that case the uncovered hostname is served plain HTTP-only rather than being given an HTTPS block its certificate does not cover — which would show visitors a browser certificate warning.
2. 2An apex redirect vhost is created when the domain is a www. name with Cloudflare and the non-www → www redirect, so the bare apex reaching your server gets a proper 301 with its own certificate.
3. 3The application's base URL is updated to the new primary.

Each domain list fetch also re-checks DNS against the server IP and corrects the stored verification state.

11. Cloudflare is a billed add-on

Enabling Cloudflare on a domain creates the service records behind it — a per-domain subscription with a trial period when one is configured, and the usage entry that appears on your invoice. Turning the integration off in Edit Domain removes the Cloudflare hostname.

The price shown on the Add Domain card is per domain, per month.

12. Sensible practice

• Add the DNS records first, then save. The confirmation checkbox is there because the reverse order leaves the domain stuck in Pending.
• For Cloudflare, use the www. form and let the apex redirect to it. Apex domains cannot take the custom hostname.
• Keep the SharkCluster subdomain until the new domain is confirmed working. It is your only way back in if something is wrong.
• Update the application's own base URL. The panel cannot do this for you and the site half-works until you do.
• Use Copy Primary Virtual Host if your current primary has hand-edited rules.
• Read the URL Status column before assuming DNS is the problem — it tells you which of the four variants actually responds.
• Change the primary domain deliberately. It rewrites the application's base URL and moves the SSL configuration.

13. Common problems

14. How this relates to other tabs