Custom Domains
Connect your own domain to your Galaxy app. CNAME records, A records, and automatic SSL certificates. Your app, your brand.
Why Custom Domains?
Your app deserves a real domain. Instead of myapp.sandbox.galaxycloud.app or myapp.us.galaxycloud.app, use app.yourcompany.com or yourcompany.com. Same app, professional branding.
Galaxy makes this simple. Point your DNS at us, add the domain in your dashboard, and we handle SSL certificates automatically. No manual certificate management. No renewal headaches.
Automatic SSL
Every custom domain gets a free certificate from ZeroSSL. Galaxy provisions it automatically and renews it before expiration. Prefer your own certificate? You can upload one instead. HTTPS just works either way.
Choose Your Setup Method
Two ways to connect your domain, depending on whether you're pointing a subdomain or a root domain.
CNAME Record (Subdomains)
For subdomains like www.yoursite.com or app.yoursite.com. Works with virtually all DNS providers. This is what Galaxy's dashboard walks you through.
A Record (Root Domains)
For root domains like yoursite.com. Points to Galaxy's load balancer IP for your region. Also what the dashboard walks you through.
Use CNAME for subdomains and A records for root domains. That's what the Add Custom Domain dialog in your dashboard guides you through for each case.
ALIAS/ANAME Records
Some DNS providers support ALIAS or ANAME records, which let a root domain point to a hostname instead of a fixed IP. If your provider supports one, you can point it at the same ingress hostname used for CNAME records. Galaxy's dashboard doesn't generate ALIAS-specific instructions though, so verify resolution yourself with dig after setup.
Add DNS Records First, Then Wait a Few Minutes
Add your DNS records first and wait 5 to 10 minutes before adding the domain in Galaxy. Some providers take a bit longer to propagate, and giving DNS a head start avoids a failed verification on the first try.
Method 1: CNAME Records (Subdomains)
CNAME is the standard approach for subdomains like www.yoursite.com, app.yoursite.com, or dashboard.yoursite.com.
Subdomain Only
CNAME records can't be used for root domains (like yoursite.com without www). For root domains, use an A record instead.
Galaxy Ingress Endpoints
Point your CNAME to the ingress hostname for your app's region. The format is {username}.{region}.ingress.galaxycloud.app:
| Region | Ingress Hostname Suffix |
|---|---|
| US | .us.ingress.galaxycloud.app |
| EU | .eu.ingress.galaxycloud.app |
| AP | .ap.ingress.galaxycloud.app |
Prefix the suffix with your Galaxy username. For example, if your username is acme-corp and your app runs in the US region, your CNAME target is acme-corp.us.ingress.galaxycloud.app.
Get the Exact Value From Your Dashboard
The Add Custom Domain dialog shows this hostname pre-filled for your app's actual region and username. Copy it from there to avoid typos.
Step-by-Step Setup
Choose Your Subdomain
Decide which subdomain you want to use. Common patterns include www.yoursite.com for your main app or app.yoursite.com for a dedicated app subdomain.
Make sure this matches the hostname you'll add in Galaxy.
Add the CNAME Record
Log into your DNS provider (GoDaddy, Cloudflare, Namecheap, Route 53, wherever you manage DNS) and create a new CNAME record.
Example for www subdomain:
- Name/Host:
www - Type:
CNAME - Value/Target:
acme-corp.us.ingress.galaxycloud.app(replaceacme-corpwith your Galaxy username, use your region's suffix) - TTL: 3600 seconds (or as recommended by your provider)
Save the record.
Wait for DNS Propagation
DNS changes take time to spread across the internet. Usually 30 minutes to 2 hours, sometimes up to 24 hours in rare cases.
Check propagation with this command:
dig www.yoursite.comYou should see a CNAME pointing to the Galaxy ingress hostname.
Add the Domain in Galaxy
Open your app in the Galaxy dashboard. Go to Settings, open the Networking tab, and click Add Custom Domain. Enter your full domain (like www.yoursite.com).
Galaxy verifies DNS is pointing correctly.
HTTPS Is Automatic
Once DNS verifies, Galaxy provisions an SSL certificate automatically (usually a few minutes). HTTPS enforcement is on by default for every custom domain, so all HTTP traffic redirects to HTTPS with no extra configuration. There's no toggle to flip: your users always get a secure connection.
That's it. Your custom domain is live with automatic SSL.
Set It as Your Primary Domain
One domain per app is the primary domain, which sets the main app URL and the value of ROOT_URL for Meteor apps. Use the star action in the Networking tab to make your custom domain primary once it's active. The primary domain has to be an active domain.
Method 2: A Records (Root Domains)
Use an A record for a root domain like yoursite.com. This points your domain to Galaxy's load balancer IP for your app's region.
Shared IP, Not Per-App
This IP is shared across every app in that region, not a dedicated IP for your app alone. You don't need to request or reserve anything, just use the value for your region.
Load Balancer IPs by Region
| Region | Load Balancer IP |
|---|---|
| US | 54.234.98.174 |
| EU | 51.44.119.105 |
| AP | 54.66.97.66 |
Confirm in Your Dashboard
These IPs can change. Always confirm the current value in the Add Custom Domain dialog for your app before creating the record.
Setup Process
Get the Load Balancer IP
Open your app in the Galaxy dashboard. Go to Settings, open the Networking tab, and click Add Custom Domain. Galaxy shows the load balancer IP for your app's region right in the dialog.
Copy this IP address.
Create the A Record
In your DNS provider, create an A record for your root domain.
Example:
- Name/Host:
@(or leave blank, depends on provider) - Type:
A - Value: The load balancer IP for your region
- TTL: 3600 seconds (or as recommended by your provider)
Add the Domain in Galaxy
After DNS propagation (30 minutes to a few hours), return to the same Add Custom Domain dialog and enter your root domain (like yoursite.com).
SSL and HTTPS Are Automatic
Once verification finishes, Galaxy provisions a certificate from ZeroSSL for your root domain automatically. HTTPS enforcement is on by default, so HTTP traffic redirects to HTTPS without any extra configuration.
Free Galaxy Subdomains
Don't have a custom domain yet? No problem. Galaxy provides free subdomains for your app. The format depends on your plan.
| Plan | Subdomain Format |
|---|---|
| Free | myapp.sandbox.galaxycloud.app |
| Paid (US East) | myapp.us.galaxycloud.app |
| Paid (EU West) | myapp.eu.galaxycloud.app |
| Paid (Asia Pacific) | myapp.ap.galaxycloud.app |
You choose your app name during deployment. If it's available, it's yours immediately.
All Galaxy subdomains come with SSL enabled by default. No DNS configuration needed. Just deploy your app and you're live immediately.
Java Clients May Reject the Shared Certificate
If a Java based client calls your app (webhooks, server to server integrations, payment or fiscal system integrations), watch for a PKIX path building failed error. Galaxy subdomains share one certificate across every app on the same wildcard (*.sandbox.galaxycloud.app, *.us.galaxycloud.app, and so on), and Java's default validation can reject that even though the chain is valid and works fine in browsers. Connect a custom domain to get a dedicated certificate and resolve it.
Migrating to Galaxy Metal Changes Your Free Domain
If your app previously ran on the old <app>.meteorapp.com domain, migrating to Galaxy Metal switches it automatically to the new galaxycloud.app format shown above, and the old domain stops resolving. Add a custom domain before migrating if you need to avoid any interruption for users relying on the old URL.
Start Free, Add Custom Later
Use a Galaxy subdomain to get started quickly. Add your custom domain whenever you're ready. Both can work simultaneously on paid plans.
SSL Certificates
Galaxy handles SSL automatically. Here's what happens behind the scenes.
Automatic Provisioning
When you add a domain, Galaxy requests a certificate from ZeroSSL. This typically completes within a few minutes. If DNS isn't pointing correctly yet, Galaxy retries a few times automatically. If it still can't verify, the domain moves to a Failed state, and you can trigger a fresh check with the re-verify action in the Networking tab (each re-verify gives three new automatic attempts).
Automatic Renewal
Managed certificates expire after 90 days. Galaxy renews them automatically before expiration. You don't need to track renewal dates or manually update anything.
Prefer to bring your own certificate? See Custom Certificates below.
Custom Certificates
Galaxy issues and renews a managed certificate for every custom domain automatically. If you'd rather use your own, upload a certificate and private key from the dashboard. This is the right choice when you need a certificate from a specific commercial CA, an EV or OV certificate, a wildcard certificate, or anything your compliance rules require.
Wildcards Need Your Own Certificate
Galaxy's managed certificates don't cover wildcard domains (*.yoursite.com). To use a wildcard, upload a custom certificate. It's the only supported path for wildcards.
Two Ways to Add One
When you add the domain: In the Add Custom Domain dialog, check Use custom certificate. Galaxy adds the domain and immediately opens the upload dialog so you can finish. The domain waits for your certificate before it starts DNS verification.
On an existing domain: Open the actions column for any custom domain in the Networking tab and click the certificate upload button. This works whether the domain currently uses a managed certificate or a custom one, so you can switch at any time.
What to Upload
You'll provide two files:
- Certificate: The full PEM chain, leaf certificate first. Accepts
.pem,.crt,.cer, or.cert. - Private key: The key that matches your leaf certificate. Accepts
.pemor.key.
Before installing anything, Galaxy validates that:
- The chain is complete, and every signature and issuer verifies.
- Exactly one private key is present, and it matches the leaf certificate.
- The certificate is currently valid (not expired, not yet-to-start).
- The certificate covers your domain through its SANs, including wildcard matches.
If any check fails, Galaxy rejects the upload and tells you why (for example, if the certificate doesn't cover the domain). Nothing changes until a valid certificate passes.
Open the Upload Dialog
Either check Use custom certificate when adding the domain, or click the certificate upload button in the domain's actions column.
Select Your Files
Choose your certificate file and your private key file. Galaxy shows each file name once it's selected.
Upload
Click Upload custom certificate. Galaxy validates both files, installs the certificate, then runs DNS verification. Once verification finishes, the domain becomes Active.
After Uploading
Galaxy stores only the details it needs to display, never the certificate or private key itself. The certificate panel shows the common name, subject alternative names (SANs), expiry date, upload time, and a SHA-256 fingerprint, so you can confirm exactly which certificate is installed.
Custom Certificates Don't Auto-Renew
Galaxy renews its managed certificates for you. Custom certificates are yours to manage. Watch the expiry date and upload a replacement before it lapses, or your domain will start serving an expired certificate.
Replacing a Certificate
Upload again from the same dialog. Galaxy keeps the current certificate serving until the new one is validated and installed, so there's no gap. If the replacement fails validation, your existing certificate stays in place.
Removing a Certificate
Removing a custom certificate from a standard domain switches it back to Galaxy's managed ZeroSSL certificate and re-runs verification. Wildcard domains are the exception: they must keep a custom certificate, so to stop using one, delete the domain instead.
WWW vs Non-WWW
Decide which format is your canonical URL, then redirect the other to it.
Primary: www.yoursite.com
- Set up a CNAME for
wwwpointing to Galaxy - Set up a root domain redirect to
www.yoursite.com - Add
www.yoursite.comas your domain in Galaxy
Most DNS providers offer URL forwarding for the root domain redirect.
Primary: yoursite.com
- Set up an A record for the root domain (or an ALIAS/ANAME if your provider supports it)
- Set up a CNAME for
wwwpointing to Galaxy (or redirect www to root) - Add
yoursite.comas your domain in Galaxy - Optionally add
www.yoursite.comas an additional domain
Both domains can work, or you can redirect www to the root.
Consistency matters. Pick one and stick with it. Search engines treat www and non-www as separate sites, so consolidating helps SEO.
Verifying Your DNS
After making changes, verify everything is working correctly.
Check DNS Records
# Check CNAME records
dig www.yoursite.com
# Check A records
dig yoursite.com
# Check from Google's DNS (bypasses local caching)
dig @8.8.8.8 yoursite.comWhat to Look For
CNAME setup: You should see a CNAME record pointing to your region's Galaxy ingress hostname.
A record setup: You should see an A record matching your region's load balancer IP.
Troubleshooting
AWS Route 53 Advanced Setup
Using AWS for your infrastructure? Route 53 provides advanced DNS features like geographic routing, health checks, and tight AWS integration.
For comprehensive AWS Route 53 documentation, see the official AWS Route 53 Developer Guide.
The short version: create a hosted zone for your domain, update your registrar's nameservers to Route 53, then create a CNAME (subdomain) or A record (root domain) pointing to the values from your Galaxy dashboard. Route 53 also supports ALIAS records natively, which you can point at your Galaxy ingress hostname instead of a fixed IP for root domains.