Kindwell. Solutions
Live from brittany-0
Custom domains on Juno Orion

Served from inside a session, on its own domain.

This page is a Node process running in a Wetty session on our Orion cluster. It is published at its own hostname through the Domain Route plugin, while the terminal it runs in stays behind the platform sign-in.

Served bybrittany-0
Hostnamewetty.kindwellsolutions.com
Uptime1h 4m
RuntimeNode v18.10.0

Rendered Fri, 25 Sep 2026 20:32:01 GMT over HTTPS.

How this request got here

Five hops, each handled by a plugin or by the platform, with no manual DNS or certificate work.

  1. DNSCloudflare answers with a CNAME to the cluster's AWS load balancer. ExternalDNS wrote that record from the route's opt-in annotation, alongside a TXT record that proves it owns it.
  2. TLSingress-nginx terminates HTTPS with the existing *.kindwellsolutions.com wildcard, so a new subdomain needs no certificate of its own.
  3. RoutingThe Domain Route Ingress sends every path on this hostname to one Service, and nowhere else.
  4. SelectionThat Service selects the session's pod by label and targets a single port, 8000.
  5. AdmissionThe session's NetworkPolicy admits that port from the ingress controller only.

What stays private

Publishing an app does not publish the session it runs in.

The terminal

Wetty's terminal is only routed on the platform host, behind Hubble sign-in. On this hostname its paths have no route to it, and this app answers them with a 404.

Everything else in the pod

Only the one published port is reachable. Other ports in the session have no Service, no Ingress, and no hostname.

The plugin suite

Proposed to the official Terra catalog, and running here from our fork.

ExternalDNS

Writes records to Cloudflare or Route53 for routes that opt in. Upsert-only by default, so it never deletes.

PR #699

Domain Route

Publishes a workload, or a port inside a session, at a hostname, with optional basic auth, rate limiting and a CIDR allow list.

PR #700

Domain Manager

A page in Genesis listing every published hostname, the record it needs, and whether DNS points here yet.

PR #701

Certificate Issuer

Creates the ACME ClusterIssuer for hostnames the wildcard cannot cover, such as a client's own domain.

PR #698

n8n and runtimes

A domain field on the templates serves each workload at <name>.<domain>, while path routing stays the default.

PR #703 PR #705

The convention

One documented pattern for adding custom domains to any workload template, byte-identical by default.

PR #706