Manage a website's origin

A website's Origin tab sets where Coritan's network sends the visitors of one hostname, such as www.example.com, and how it connects to your origin: the server that holds your website (Origins). It also sets what visitors see while your origin is down, and turns on development mode while you debug. Each setting belongs to the hostname's web proxy and changes that hostname only.

• The domain is on your Domain Management list.
• The hostname is on Coritan's network: it has a web proxy, or its A or AAAA record on the DNS tab is Proxied (Web proxies and DNS records). When no hostname of the domain is, the tab offers ways to put the domain there (Put the domain on Coritan's network).
• To connect the domain to one of your servers, you need a server on App Deployment with an address and a port.

1. In the dashboard, go to Domain Management, open the domain and select the Origin tab.
2. When the domain has more than one hostname on Coritan's network, choose one in Settings for at the top of the tab. The other tabs keep the hostname you choose.

On the DNS tab, Hostname settings on a proxied record's row opens the Origin tab at that record's hostname. The tab has four cards: Where requests go, Connection to your origin, When your origin is down and Delete this web proxy. A hostname whose origins follow its DNS records gets its own first and last card (A hostname that follows its DNS records).

When no hostname of the domain is on Coritan's network yet, the tab says example.com is not on our network yet and offers two ways to put the domain there. When Coritan hosts the domain's DNS zone, Proxy a DNS record also opens the DNS tab at the records that are DNS only, so you can proxy the one that points at your server (Proxied records).

1. On the Connect to one of your servers card, choose the Server. The card then names the address and port that requests will go to.
2. Leave Request a certificate automatically on, so Coritan issues a certificate for the domain.
3. Select Connect domain.

The dashboard confirms example.com now points at 203.0.113.10:8080. The web proxy starts with Always use HTTPS, the WAF and WebSockets on, and connects to the server over plain HTTP. When you have no server yet, the card says You have no servers to connect to yet. and offers Order server.

For a server somewhere else, such as a Cloud Compute instance or another host:

1. On the Use any other server card, select New web proxy…. The New web proxy page opens under the tab.
2. Under Origin, enter the Origin host, an IP address or a hostname such as origin.example.net, without https:// and without the port.
3. Enter the Port your origin answers on.
4. Select Connect to your origin over HTTPS when your origin serves HTTPS on that port. Selecting it changes port 80 to 443, and clearing it changes 443 back to 80. Coritan's network then encrypts the connection and checks your origin's certificate.
5. Select Create web proxy. To leave without creating it, select Cancel or the Origin link above the heading.

The dashboard confirms Web proxy for example.com created. and takes you back to the Origin tab. The web proxy starts with Always use HTTPS, the WAF and WebSockets on, and Coritan requests a certificate for it. When Coritan hosts the zone and the domain has no A, AAAA or CNAME record yet, Coritan adds a proxied A or AAAA record for it, so visitors reach Coritan's network. When another provider hosts the zone, point the domain at Coritan's network there (Web proxies and DNS records).

The Where requests go card lists the hostname's origins: the origin host first, then any additional origins, each with its port and HTTPS or HTTP. With more than one, Coritan's network sends each request to the origin with the fewest requests in progress, and tries the next one when an origin cannot be reached (Origins).

When the hostname redirects every visitor to another address, the card says that Coritan's network does not contact your origin while the redirect is on. Open Rules opens the redirect (Redirect the whole hostname).

1. On the Where requests go card, select Edit origin…. The Edit origin page opens under the tab.
2. Under Origin host, enter the Origin host and its Port.
3. To share requests between several servers, select Add origin under More origins and enter each server's host and port. Choose its origin protocol, or leave Web proxy default to use the hostname's own, and select TLS when Coritan's network should reach it over HTTPS. Remove origin takes one off the list.
4. Select Save origin.

The dashboard confirms Origin for www.example.com saved. The dashboard takes you back to the Origin tab. A change the API refuses keeps the page and what you entered, with the reason under the heading Could not save the origin, such as Could not save the origin: host targets a private or reserved network. Whether Coritan's network reaches the origin host over HTTPS depends on the encryption mode (Connection to your origin).

1. On the Where requests go card, select Repoint at one of your servers…. The Repoint at one of your servers page opens under the tab.
2. Under Server, choose the Server.
3. Under Certificate, leave Request a certificate automatically on to request a certificate at the same time.
4. Select Repoint origin.

The dashboard confirms www.example.com now points at 203.0.113.10:8080. Coritan replaces the origin host and port with the server's address and port. Your additional origins and the connection settings stay as they are. When the encryption mode encrypts the connection to your origin and the server answers plain HTTP on its port, choose Flexible on the SSL/TLS tab (Choose an encryption mode).

When a proxied A or AAAA record made the hostname's web proxy, its origins are the addresses in those records. The Where requests go card lists each address with the kind of record that holds it. Edit DNS records opens the DNS tab at the hostname's proxied records: change an address there, and Coritan's network follows it (Web proxies and DNS records).

The port is the one part of the origin you set on this tab:

1. On the Where requests go card, select Change port. A form opens on the card.
2. Enter the Port, from 1 to 65535.
3. Select Save port, or Cancel to close the form.

The dashboard confirms Port for shop.example.com set to 8080. Coritan's network connects to every address on that port. Such a web proxy starts on plain HTTP to port 80. Once every address answers HTTPS on port 443, Coritan's network moves the connection there by itself. It checks when you proxy the records and each time they change. Choosing an encryption mode on the SSL/TLS tab also moves port 80 to 443, and back.

Its last card is titled Take shop.example.com off our network and offers no delete, because the proxied records would make the web proxy again. To take the hostname off Coritan's network, set those records to DNS only on the DNS tab, which Edit DNS records opens. Visitors then reach your server directly, and the web proxy goes with the last proxied record.

The Connection to your origin card sets how Coritan's network talks to your origin. Each switch saves as soon as you change it, with a confirmation such as WebSockets turned off for www.example.com.

Origin protocol

The HTTP version Coritan's network speaks to your origin: HTTP/1.1, HTTP/2 over TLS, HTTP/2 cleartext or Negotiate (Origin protocols). Select Change protocol, choose one and select Save protocol. Keep HTTP/1.1 unless your origin asks for another. While gRPC is on, you cannot choose HTTP/1.1.

Encryption

Your encryption mode, Flexible, Full or Full (strict), which says whether Coritan's network encrypts the connection to your origin and checks its certificate. Open SSL/TLS opens the tab that changes it (Choose an encryption mode). The mode applies to the origin host, and each additional origin keeps its own TLS setting. HTTP/2 cleartext never encrypts the connection, whatever the mode says.

PROXY protocol to origin

Coritan's network starts each connection to your origin with a header that carries the visitor's IP address. Turn it on only when your origin expects it, or every request to your origin fails. You confirm with Turn on PROXY protocol. Your origin also gets the visitor's address in the X-Forwarded-For and X-Real-IP headers (What your origin receives).

WebSockets

Lets a page keep a live connection open to your origin, as chat and live updates do. While it is off, Coritan's network refuses WebSocket requests.

gRPC

Lets apps call your gRPC services through Coritan's network, and browsers call them with gRPC-Web. Your origin must speak HTTP/2, so turning gRPC on while the origin protocol is HTTP/1.1 changes it to Negotiate. The WAF does not check the body of a gRPC request.

Limits

Select Edit limits, change them and select Save limits. Max upload size is the largest request a visitor can send, from 1 to 100 MB, and Coritan's network refuses a larger one with error 413. Origin timeout is how long Coritan's network waits for your origin to answer, from 1 to 120 seconds. After that, visitors get the error page for 504. A new web proxy has 100 MB and 60 seconds.

The When your origin is down card sets what visitors see when Coritan's network cannot reach your origin (error 502) or your origin takes too long to answer (error 504). Its Error page row says which page visitors get now: your own, the Coritan page, or the page of the brand that the web proxy belongs to when that brand has one turned on.

1. On the When your origin is down card, select Edit error page.
2. Turn on Use your own error page.
3. Enter the page's words and links, choose its look, and check the preview beside the form. Customise the error page describes each field.
4. Select Save error page.

The dashboard confirms Error page for www.example.com saved. Cancel puts back the saved page. To go back to the page the hostname inherits, turn Use your own error page off and save. Your words and settings stay saved for the next time you turn it on.

Development mode helps you debug a site that does not answer. While it is on, Coritan's error pages for the hostname show your origin's address and what failed, whatever your own error page says. Every answer from your origin also carries a Coritan-Origin header with the address and port of the origin that sent it, so you can tell which of several origins answered. Anyone can read these details, so turn development mode off when you are done.

1. On the When your origin is down card, choose in Turn it off after how long it stays on: 1 hour, 3 hours, 12 hours, 24 hours or Until you turn it off. The card starts on 3 hours.
2. Turn on Development mode.

The dashboard confirms Development mode turned on for www.example.com for 3 hours. The row then says when it turns off by itself, or On until you turn it off. Development mode does not skip the cache, so clear a file you changed to see it at once (Development mode does not skip the cache).

A website's cache settings are on its Caching tab (Speed up a website with the cache).

1. On the Delete this web proxy card, select Delete web proxy….
2. Type the hostname, such as www.example.com, to confirm.
3. Select Delete web proxy.

The dashboard confirms Web proxy for www.example.com deleted., and the tab goes back to the domain itself. The hostname's DNS records stay as they are. A proxied record keeps sending visitors to Coritan's network, which answers 404 until the hostname has a web proxy again, so set the record to DNS only on the DNS tab to send visitors to your server directly. A hostname that follows its DNS records offers no delete (A hostname that follows its DNS records).

Each change shows a confirmation that names the hostname, such as Origin for www.example.com saved. or gRPC turned on for www.example.com., and the cards show the new values. When the API refuses a switch, the switch goes back, and the message starts with Could not change, then names the setting, the hostname and the reason.

Could not save the origin: host targets a private or reserved network. or resolved address targets a private or reserved network

Coritan's network forwards only to public addresses, so an origin such as 10.0.0.10 is refused. Enter your origin's public address.

Unable to resolve hostname: origin.example.net

The origin host does not resolve in public DNS. Check its spelling, or enter your origin's IP address.

Hostname targets a private or reserved name

localhost, and names that end in .local, .localhost or .internal, cannot be origins.

Leave https:// out of the origin host. The port and TLS have their own fields., Leave the port out of the origin host. It has its own field. or The origin host is a hostname or an IP address, such as origin.example.net.

The Origin host takes a bare hostname or IP address. Enter the port in Port.

Enter a port between 1 and 65535., The origin port must be between 1 and 65535. or Origin 203.0.113.11 needs a port between 1 and 65535.

Enter each port as a whole number from 1 to 65535.

Enter a size between 1 and 100 MB. or Enter a time between 1 and 120 seconds.

Max upload size takes a whole number from 1 to 100, and Origin timeout a whole number from 1 to 120.

Could not create the web proxy: You must own this domain (via registration or DNS zone) to create a route or Could not connect the domain: You must own this domain (via registration or DNS zone)

Coritan makes a web proxy only for a domain you registered here, or one whose DNS zone is on your account, and for the names under it. Add the domain's DNS zone (Add a domain you already own), then try again.

Could not create the web proxy: A route for this domain already exists or Could not connect the domain: Domain route owned by another user

Another account or an organization has a web proxy for the name. Contact support.

Could not connect the domain: Server has no allocated IP/port. Ensure the server has an active allocation.

The server has no address and port yet. Wait until its setup finishes, or choose another server.

The dashboard offers a plan in place of the web proxy

Once account plans open on your account, a web proxy for a name outside your DNS zones is one of your plan's websites, and your plan has none left (When you reach a limit).

Every request fails after you turn on PROXY protocol to origin

Your origin does not expect the PROXY protocol header. Turn the switch off, or set your origin up to read the header.

Visitors get error 413

The request is larger than Max upload size. Raise it, up to 100 MB.

Visitors see an error page from Coritan

Coritan's network cannot reach your origin, or your origin took longer than the Origin timeout. Turn on development mode to see what failed. Troubleshoot proxies and join addresses explains each failure.

• How web proxies work
• Customise the error page
• Choose an encryption mode
• Speed up a website with the cache
• Redirect visitors and set headers

Each setting on this tab is a field of the hostname's web proxy. GET /api/v1/proxy/routes lists your web proxies with their id and domain, up to 200 a page, and GET /api/v1/proxy/routes/{route_id} returns one with every setting. Its origin_follows_dns is true when its origins follow its DNS records.

curl "https://api.coritan.com/api/v1/proxy/routes?per_page=200" \
  -H "Authorization: Bearer $CORITAN_TOKEN"

Change settings with PATCH /api/v1/proxy/routes/{route_id}, sending only the fields to change:

curl -X PATCH https://api.coritan.com/api/v1/proxy/routes/31 \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "upstream_host": "203.0.113.10",
    "upstream_port": 8080,
    "upstream_backends": [{"host": "203.0.113.11", "port": 8080, "ssl": false}],
    "upstream_protocol": "auto",
    "timeout_seconds": 90
  }'

The answer is {"message": "Route updated"}.

The encryption mode is set on the SSL/TLS tab (Choose an encryption mode). A value out of range answers 422. An origin host on a private network, or one that does not resolve, answers 400 with the reason. For a web proxy whose origins follow its DNS records, a change to upstream_host or upstream_backends answers 409, and upstream_port applies to every address:

{
  "detail": {
    "error": "origin_follows_dns",
    "message": "The origin of shop.example.com follows its proxied DNS records. Change its A or AAAA records on the DNS tab."
  }
}

Delete a web proxy with DELETE /api/v1/proxy/routes/{route_id}, which answers {"message": "Route deleted"} (Change a web proxy's settings). For a web proxy whose origins follow its DNS records, it answers 409 with origin_follows_dns. Turn the records' proxy status off instead, and the web proxy goes with the last one.

New web proxy… and Connect domain call POST /api/v1/proxy/routes and POST /api/v1/proxy/routes/connect-domain (Create a web proxy). The error page preview is POST /api/v1/proxy/routes/{route_id}/error-page/preview (Customise the error page).