Create a web proxy

Create a web proxy to serve a hostname, such as www.example.com, through Coritan's edge. The edge then answers HTTPS for the name with a free certificate, checks requests with the web application firewall (WAF) and forwards them to your origin (How web proxies work). The origin can be one of your servers hosted here, whose address Coritan fills in, or any public address.

A web proxy belongs to a website, so you create it on the website's Origin tab. A hostname of the website, such as www.example.com, gets its web proxy when you turn Proxied on for its A or AAAA record on the DNS tab (Proxied records).

• The name is a domain you registered with Coritan, a name in a DNS zone on your account, or a name under your free coritan.gg name. A web proxy for app.example.com only needs the example.com zone (Add a domain you already own, Claim a free coritan.gg name).
• The name has no web proxy yet. Each name can have one web proxy on the whole platform.
• To forward to a server hosted here, you need a server on App Deployment with an address and a port. For any other origin, you need its public IP address or hostname and its port.
• Visitors reach the web proxy once the name resolves to Coritan's network (Web proxies and DNS records).

1. In the dashboard, go to Domain Management, open the domain and select the Origin tab. When the domain is already on Coritan's network, the tab shows its settings instead of the cards below, and Repoint at one of your servers… does the same job (Manage a website's origin).
2. On the Connect to one of your servers card, choose the Server. The card shows the address and port that requests will go to. It is unavailable while your account has no servers.
3. Leave Request a certificate automatically on, so Coritan requests a certificate for the name.
4. Select Connect domain.

The web proxy forwards to the server's address and port over plain HTTP. It starts with Force HTTPS, WebSockets and Web application firewall on, a 100 MB request body limit and a 60 second origin timeout.

1. In the dashboard, go to Domain Management, open the domain and select the Origin tab.
2. On the Use any other server card, select New web proxy…. The New web proxy page opens under the tab.
3. Enter the Origin host: an IP address, such as 203.0.113.10, or a hostname, such as origin.example.net. Leave out https:// and the port.
4. Enter the origin's Port. It starts at 80.
5. Select Connect to your origin over HTTPS when the origin serves HTTPS on that port. Selecting it changes port 80 to 443.
6. Select Create web proxy.

The web proxy starts with Force HTTPS, WebSockets and Web application firewall on, and Coritan requests a certificate for it.

A web proxy's other settings are on the website's tabs, one hostname at a time:

Strip path prefix and Prepend origin path

The path rewrite on the Rules tab removes a path from the start of the request path, such as /api, and adds one in front of it, such as /v2. What your origin receives shows both prefixes at work (Redirect visitors and set headers).

Custom request headers

The Rules tab adds headers to every request Coritan's network forwards.

Additional origins

Edit origin… on the Origin tab takes more origins that share the requests with the origin host: select Add origin, enter the host and port, choose a protocol or leave Web proxy default, and select TLS for an origin that serves HTTPS. Coritan's network does not check their health, so each one must serve the whole site.

Max upload size and Origin timeout

Edit limits on the Origin tab sets the largest request body, from 1 to 100 MB (it starts at 100), and how long Coritan's network waits for the origin, from 1 to 120 seconds (it starts at 60).

The dashboard confirms Web proxy for example.com created. or example.com now points at 203.0.113.10:8080. and shows the website's Origin tab with the new settings. Coritan requests the certificate in the background, and the SSL/TLS tab shows its state.

When Coritan hosts the zone and the name has no A, AAAA or CNAME record, Coritan also adds a proxied A or AAAA record for the name. When another provider hosts the zone, point the name at Coritan's network there (Web proxies and DNS records).

Leave https:// out of the origin host. The port and TLS have their own fields.

Enter only the host in Origin host. Put the port in Port, and turn on Connect to the origin over TLS for HTTPS.

Leave the port out of the origin host. It has its own field.

Remove :8080 or any other port from Origin host, and enter it in Port.

The origin host is a hostname or an IP address, such as origin.example.net.

Origin host holds a character that no hostname has, such as a space or a slash. Enter the bare hostname or address.

The origin port must be between 1 and 65535. or Origin 203.0.113.11 needs a port between 1 and 65535.

Enter a port from 1 to 65535 for the origin host, or for the additional origin that the message names.

Every custom header needs a name.

A custom request header has a value but no name. Enter the name, or select Remove header.

A wildcard name cannot have a web proxy. Add a route for each hostname instead.

The domain has a * in it. The edge looks a web proxy up by the visitor's exact hostname, so create one for each name you serve. POST /api/v1/proxy/routes/connect-domain answers the same.

You must own this domain (via registration or DNS zone) to create a route

The name is not under a domain you registered here or a DNS zone on your account. Add the zone first (Add a domain you already own). The form for a server hosted here says You must own this domain (via registration or DNS zone).

A route for this domain already exists

The name already has a web proxy. When a proxied A or AAAA record in your zone made it, it is on the website's tabs: change it there. To send the name somewhere other than the record's address, forward it to a server hosted here with Repoint at one of your servers…, which takes that web proxy over, or turn Proxied off for the record, create the web proxy and turn Proxied on again. If the name has no proxied record and the website's tabs show no web proxy for it, another account holds it, and you can contact support.

Domain route owned by another user

Another account has a web proxy for the name. Contact support.

Server has no allocated IP/port. Ensure the server has an active allocation.

The server has no address and port yet. Wait until its setup finishes, or choose another server.

Unable to resolve hostname: origin.example.net

The origin host does not resolve in public DNS. Check its spelling, or enter the origin's IP address.

host targets a private or reserved network, resolved address targets a private or reserved network or Hostname targets a private or reserved name

Coritan's network only forwards to public addresses. It refuses private and reserved networks, localhost, and names that end in .local, .localhost or .internal. Enter the origin's public address.

Connect to one of your servers is unavailable

Your account has no servers. Order a server, or use Use any other server and enter the origin's address.

• How web proxies work
• Change a web proxy's origin
• Redirect requests with rules
• Manage a website's origin

Create a web proxy for any origin with POST /api/v1/proxy/routes. domain is required, and so is upstream_host unless you send redirect_to for a whole-domain redirect. domain is a full hostname such as app.example.com. Coritan stores it in lowercase without a trailing dot. A wildcard name such as *.example.com answers 422.

curl -X POST https://api.coritan.com/api/v1/proxy/routes \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "domain": "www.example.com",
    "upstream_host": "203.0.113.10",
    "upstream_port": 8080,
    "auto_ssl": true
  }'

The call takes every field that Change a web proxy's origin lists, except development_mode, development_mode_minutes and error_page, and a field you leave out takes the default shown there. It also takes auto_ssl, true by default, which requests a certificate for the name. The answer is 201:

{
  "id": 31,
  "domain": "www.example.com",
  "status": "active",
  "ssl_status": "pending",
  "dns": {"zone": "example.com", "name": "www", "created": true, "type": "A"}
}

ssl_status is pending when a certificate was requested and off when it was not. dns is null when Coritan does not host the zone or could not add a record, and created is false when a record already answers for the name.

Forward a name to one of your servers with POST /api/v1/proxy/routes/connect-domain. It takes the server's server_uuid, which GET /api/v1/client/servers lists, the domain and auto_ssl:

curl -X POST https://api.coritan.com/api/v1/proxy/routes/connect-domain \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"server_uuid": "8c2b1f4e-5d3a-4e7b-9f10-2a6c4d8e1b37", "domain": "www.example.com", "auto_ssl": true}'

{
  "message": "Domain connected to server",
  "domain": "www.example.com",
  "upstream": "203.0.113.10:8080",
  "route_id": 31,
  "ssl_status": "pending",
  "dns": {"zone": "example.com", "name": "www", "created": true, "type": "A"}
}

A server that does not exist answers 404 with Server not found, and another account's server answers 403 with You do not own this server. The other errors are those in Troubleshooting. A value outside its range, such as a max_body_size_mb of 200, answers 422.