Infrastructure

Domain & TLS

DNS and certificates

Domain and TLS

Production and Stage each require their own fully qualified domain name (FQDN). ERP is served over HTTPS on port 443 — application ports stay private.

Production domain

Set your Production hostname during install:

sudo soviez.sh --new --domain erp.example.com

Or enter the domain when prompted during --new.

Item	Detail
DNS	A or AAAA record pointing to your server’s public IP
Nginx	Listens on public `:80` and `:443`
Certificates	Let’s Encrypt via Certbot when DNS validates (HTTP-01 challenge)
Fallback	Self-signed certificate may remain until Certbot succeeds

Example: https://erp.example.com serves your live ERP.

Stage domain

Stage requires a separate domain or subdomain:

soviez.sh --stage --production-tenant <id> --stage-domain stage.example.com

Stage has its own certificate lifecycle, independent of Production.

Cloudflare

Optional edge mode is available via SOVIEZ_EDGE_MODE=cloudflare_aop. Not required for standard deployments. See CLOUDFLARE.md.

SSL commands

soviez.sh --ssl-status [environment-id]
soviez.sh --ssl-renew <environment-id>
soviez.sh --ssl-repair <environment-id>
soviez.sh --ssl-policy <environment-id> [automatic|notify_only|manual]
soviez.sh --ssl-try-again <environment-id>
soviez.sh --ssl-abort <environment-id>

Certificate renewal and repair are designed to not stop ERP as a side effect of a renewal failure.

Troubleshooting

Symptom	What to check
TLS / certificate error	Certificate path, domain in cert matches URL, Certbot logs
Domain not resolving	DNS A/AAAA record, propagation delay
HTTP works, HTTPS fails	Certificate installed, Nginx `ssl` listen block
Wrong domain in browser	DNS pointing to wrong server, Cloudflare proxy settings