Domains & TLS

DNS#

Create an A record for your LokiPay domain pointing at the server (and AAAA for IPv6 if you have it). If you use Cloudflare, set the record to DNS only (grey cloud) so Let’s Encrypt can validate and the relay app talks to your server directly.

Certificates#

deploy.sh obtains a certificate with certbot --webroot using SSL_EMAIL and installs a renewal hook that reloads nginx. Renewal is automatic.

nginx#

• Requests are proxied to the API on the loopback port.
• Request bodies are limited to 1 MB, except APK uploads at /admin/app-releases (160 MB).
• Rate limits: /device/* 60 requests/minute per IP, /admin/auth/login 10/minute per IP (on top of the application limits in rate limits).

Changing the domain#

1. Point the new DNS record at the server.
2. Update PUBLIC_URL in the server .env and DOMAIN in your deploy.env, then run ./deploy.sh.
3. Re-pair relay phones (their saved server URL changes) and update links you have shared.