TLS Certificates

Broch requires a TLS certificate covering both your chosen hostname and its wildcard: broch.{your-domain} serves the dashboard, API, and health endpoints; *.broch.{your-domain} serves the tunnel URLs. A wildcard alone doesn’t cover the bare name, and a single-name certificate doesn’t cover the tunnels. The automated setups below (Caddy ACME, AWS ACM) issue certs for both names.

Broch itself doesn’t terminate TLS — that’s the job of the reverse proxy or load balancer in front of it. Each deployment platform handles certs differently:

Docker Compose

The compose variants cover two paths:

Option A — Caddy with automatic ACME (recommended): with-postgres and with-postgres-external ship a Caddyfile that obtains and renews the wildcard cert automatically via ACME DNS-01. You provide a DNS provider API token and a Let’s Encrypt email (CADDY_ACME_EMAIL) at startup; no manual certificate management. Cloudflare is the default. Azure DNS, Route 53, Google Cloud DNS and DigitalOcean are built into the same Caddy image: switch the dns block in tls.caddy to one of the per-provider snippets and set that provider’s credentials in .env. On Docker Compose use cloudflare, azure-mi, azure-spn, route53, googleclouddns or digitalocean; godaddy is for the DigitalOcean module and route53-iam for the AWS appliance.

For Cloudflare: create an API token scoped to your zone with Zone:Read + DNS:Edit (the dashboard’s “Edit zone DNS” template, at https://dash.cloudflare.com/profile/api-tokens) and pass it as CLOUDFLARE_API_TOKEN. Caddy proves zone control via DNS-01 and Let’s Encrypt issues the wildcard — you never create certificate records by hand. The same credential can also keep your A records pointed at the host: see Wildcard Domain & DNS.

Turn the Cloudflare proxy (orange cloud) OFF for these records. The proxy re-encrypts with its own certificate (conflicting with Caddy’s TLS), hides real client IPs, and the DNS-01 challenge must reach Cloudflare’s DNS API rather than the proxy edge.

Option B — Bring your own cert: with-postgres-byo-cert ships a Caddyfile with auto_https off and a static tls directive pointing at certs/fullchain.pem and certs/privkey.pem, which you provide. Create both before you start the stack: Docker turns a missing one into an empty directory. Use this when your DNS isn’t on a Caddy-supported provider, you have central PKI / a commercial CA, you use certbot externally with your own renewal automation, or you’re in a restricted-egress network where Caddy can’t reach Let’s Encrypt during issuance.

DigitalOcean

Like Docker Compose Option A, the Droplet runs Caddy with ACME DNS-01, but only for DNS on DigitalOcean, Cloudflare or GoDaddy (dns_provider = digitalocean, cloudflare or godaddy, with its token in dns_api_token). Caddy issues and renews the certificate for the hostname and its wildcard.

See the DigitalOcean installation guide.

Azure (Container Apps)

The default Container Apps managed cert covers the hostname itself but doesn’t issue wildcards, the main reason the Azure appliance runs on a VM instead. If you run the beta Container Apps module anyway, tunnel subdomains (*.broch.{your-domain}) leave you three options:

1. Front Door or Application Gateway in front of Container Apps, serving a wildcard cert you provide (from Key Vault). Neither issues a managed wildcard cert for you.
2. Upload a wildcard cert to the Container Apps environment (Let’s Encrypt via certbot + DNS-01, or a commercial CA) with az containerapp env certificate upload, then bind it with az containerapp hostname bind.
3. Skip wildcards if your deployment doesn’t use tunnel subdomains.

Either way, the cert is yours to renew. See the Azure Container Apps guide for binding the hostname.

AWS ECS Fargate (ALB)

AWS Certificate Manager (ACM) handles the wildcard cert via DNS validation. The beta Terraform module creates an ACM cert covering broch.{your-domain} and *.broch.{your-domain}, then DNS-validates it against your Route 53 zone — all automatic on terraform apply. ACM handles automatic renewal in perpetuity. No manual cert management.

See the AWS ECS Fargate guide.

Next: Ingress & Reverse Proxy, step 4 of the self-managed checklist.