# Is it possible to CNAME to the zrok share URL and also use letsencrypt to get TLS support? **URL:** \ **Category:** Building/Development\ **Created:** [June 14, 2024, 3:11pm UTC](https://openziti.discourse.group/t/is-it-possible-to-cname-to-the-zrok-share-url-and-also-use-letsencrypt-to-get-tls-support/2719 "2024-06-14T15:11:23Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![fedex1](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/fedex1/32/2219_2.png) [@fedex1](https://openziti.discourse.group/u/fedex1)\ **Post date:** [June 14, 2024, 3:11pm UTC](https://openziti.discourse.group/t/is-it-possible-to-cname-to-the-zrok-share-url-and-also-use-letsencrypt-to-get-tls-support/2719/1 "2024-06-14T15:11:23Z")
Is it possible to CNAME to the zrok share URL and also use letsencrypt to get TLS support? Basically can this be done? I'd like to hide the ZROK share URL and use my own domain? For example go to [NYC New Proposed Property Tax Calculator 2024 based on recent tax advisory commission proposal](https://app.tidalforce.org/newtax) This redirects to [NYC New Proposed Property Tax Calculator 2024 based on recent tax advisory commission proposal](https://propmarketing.share.zrok.io/newtax#gsc.tab=0) But I'd rather CNAME and subdomain such as [appv2.tidalforce.org](http://appv2.tidalforce.org) to [propmarketing.share.zrok.io](http://propmarketing.share.zrok.io) and redirect to [appv2.tidalforce.org](http://appv2.tidalforce.org) But I do not have TLS / letsencrypt set up for [appv2.tidalforce.org](http://appv2.tidalforce.org) ---
**Author:** ![michael.quigley](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/michael.quigley/32/1123_2.png) [@michael.quigley](https://openziti.discourse.group/u/michael.quigley)\ **Post date:** [June 14, 2024, 4:38pm UTC](https://openziti.discourse.group/t/is-it-possible-to-cname-to-the-zrok-share-url-and-also-use-letsencrypt-to-get-tls-support/2719/2 "2024-06-14T16:38:46Z")
With the public frontend on [zrok.io](http://zrok.io), it's not possible as that uses the `Host` header to route traffic to the correct share. What you COULD do is pick up a cheap VPS or container hosting and run your own `zrok access private`, and put a CNAME in front of that. If you wanted TLS, stick the `zrok access private` behind an nginx or Caddy proxy with TLS configured. ---
**Author:** ![michael.quigley](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/michael.quigley/32/1123_2.png) [@michael.quigley](https://openziti.discourse.group/u/michael.quigley)\ **Post date:** [June 14, 2024, 4:39pm UTC](https://openziti.discourse.group/t/is-it-possible-to-cname-to-the-zrok-share-url-and-also-use-letsencrypt-to-get-tls-support/2719/3 "2024-06-14T16:39:32Z")
Check out this thread: > [@Cant forward to a Dedicated Custom Domain Name](https://openziti.discourse.group/t/cant-forward-to-a-dedicated-custom-domain-name/2541/8): > > [zrok.io](http://zrok.io) today supports private shares: [Private Shares | Zrok](https://docs.zrok.io/docs/concepts/sharing-private/). A private share does not have a public address, and can only be accessed via zrok [zrok.io](http://zrok.io) today supports reserved shares: [Reserved Shares | Zrok](https://docs.zrok.io/docs/concepts/sharing-reserved/). A reserved share lets you set the name of the share a client uses to access it. E.g., [https://MYRESERVEDSHARENAME.share.zrok.io](https://MYRESERVEDSHARENAME.share.zrok.io) We are currently working on a "dedicated custom domain" for the hosted zrok offering, which will allow you to configure your own custom replacement of the ".sh… ---
**Author:** ![fedex1](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/fedex1/32/2219_2.png) [@fedex1](https://openziti.discourse.group/u/fedex1)\ **Post date:** [June 14, 2024, 8:40pm UTC](https://openziti.discourse.group/t/is-it-possible-to-cname-to-the-zrok-share-url-and-also-use-letsencrypt-to-get-tls-support/2719/4 "2024-06-14T20:40:55Z")
@michael.quigley Thank you very much. I thought so. Therefore, I was trying to load the entire openziti and ZROK on a VPS using docker. Are you saying that I only need a VPS and install nginx/caddy, letsencrypt for TLS and ZROK and I can use the public facing [ZROK.io](http://ZROK.io) interface? I apologize for the question. Thanks. Do I need letsencrypt at all or it appears that Caddy says it supports on demand TLS? ---
**Author:** ![michael.quigley](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/michael.quigley/32/1123_2.png) [@michael.quigley](https://openziti.discourse.group/u/michael.quigley)\ **Post date:** [June 14, 2024, 10:05pm UTC](https://openziti.discourse.group/t/is-it-possible-to-cname-to-the-zrok-share-url-and-also-use-letsencrypt-to-get-tls-support/2719/5 "2024-06-14T22:05:42Z")
If you wanted to use the service at [zrok.io](http://zrok.io) to be your OpenZiti and zrok infrastructure, you could install just `zrok access private `, fronted by an nginx/Caddy reverse proxy and have your own custom domain with TLS today. You don't need to self-host all of zrok and OpenZiti unless you want to. So you would create a private share using `zrok share private`, and then your VPS would be your "frontend", accepting web requests from the internet. But the traffic between them would traverse the shared zrok instance at [zrok.io](http://zrok.io). ---
**Author:** ![michael.quigley](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/michael.quigley/32/1123_2.png) [@michael.quigley](https://openziti.discourse.group/u/michael.quigley)\ **Post date:** [June 15, 2024, 12:55am UTC](https://openziti.discourse.group/t/is-it-possible-to-cname-to-the-zrok-share-url-and-also-use-letsencrypt-to-get-tls-support/2719/6 "2024-06-15T00:55:57Z")
I'll try and put a picture of this model together next week, so it's clearer. ---
**Author:** ![stefanadelbert](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/stefanadelbert/32/2121_2.png) [@stefanadelbert](https://openziti.discourse.group/u/stefanadelbert)\ **Post date:** [June 15, 2024, 2:19am UTC](https://openziti.discourse.group/t/is-it-possible-to-cname-to-the-zrok-share-url-and-also-use-letsencrypt-to-get-tls-support/2719/7 "2024-06-15T02:19:32Z")
I've recently had success with both of these approaches, - Caddy (with TLS and oauth) reverse-proxying private shares on a VPS using my own domain - Self-hosted zrok+openziti using [this guide](https://docs.zrok.io/docs/guides/self-hosting/linux/) using my own domain Here are my mermaid diagrams. ## [zrok.io](http://zrok.io) hosted - private shares - TLS handled by Caddy - oauth handled by `zrok` ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/e/e1f712b9ccdbeb246b7adc6c01172eece8125f93.png) ```mermaid graph D["DNS"] R["Requester"] ​subgraph VPS C["Caddy"] end A1["Private Endpoint 1"] A2["Private Endpoint 2"] note1>"Auth (google OAuth2)"]:::note note2>"zrok access private"]:::note note3>"zrok share private"]:::note classDef note fill:#fff9c4 R -->|"*.mydomain.io"| D D -->|"static\nIP address"| C C --> A1 C --> A2 note1 -.- C note2 -.- C A1 & A2 -.- note3 ``` ## Self-hosted - public shares - TLS handled by Caddy - oauth handled by Caddy (caddy-security) ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/6/60cce3400980697c47411a11ebcbd11786d4f07b.png) ```mermaid graph D["DNS"] R["Requester"] subgraph VPS C["Caddy+zrok"] end A1["Private Endpoint 1"] A2["Private Endpoint 2"] note3>"zrok share public oauth"]:::note note4>"Caddy configured for\neach public share"]:::note classDef note fill:#fff9c4 R -->|"*.mydomain.io"| D D -->|"static\nIP address"| C A1 -->|"reserved public share + oauth"| C A2 -->|"reserved public share + oauth"| C note3 -.- A1 note3 -.- A2 note4 -.- C ``` ---
**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\ **Post date:** [June 17, 2024, 2:05pm UTC](https://openziti.discourse.group/t/is-it-possible-to-cname-to-the-zrok-share-url-and-also-use-letsencrypt-to-get-tls-support/2719/8 "2024-06-17T14:05:55Z")
I wrote the Linux and Docker self-hosting guides, and I recommend the Docker approach for administrative convenience, assuming you're comfortable with Docker Compose. The Linux guide doesn't yet provide any packaging for system services, etc., but that's a feature of Docker. Additionally, it's easy to manage the configuration of the zrok instance and upgrade/downgrade zrok versions. The Linux guide mentions using Nginx and provides an example, but the Docker guide has a built-in option for Caddy, which can also manage your TLS certificate renewals. It's the best option for a tiny scale zrok instance IMO. [https://docs.zrok.io/docs/guides/self-hosting/docker/](https://docs.zrok.io/docs/guides/self-hosting/docker/)