Skip to content

Domains and URLs

Applies to: All subscriptions

Purpose

Explain the hostname model so that certificates, firewall rules, content-security policies and email links are all configured against the right names — and so a change of environment does not silently produce links pointing at the wrong place.

Audience

Infrastructure engineers, network engineers, security reviewers, and anyone configuring a proxy or content-security policy.

Prerequisites

Reference

Four domains, four jobs

Domain Used for
complifly.in The main application, its API, product documentation and the in-product help centre — all subdomains
complifly.tech The status page, hosted apart from the application so it survives an outage
complifly.info Public marketing content and SEO
complifly.online Reserved for a planned design serving generated files as signed links; not in use in this release

Surfaces

Surface Typical hostname Notes
Application app.complifly.in Where users sign in
API api.complifly.in May be the same origin as the application, or separate
In-product help help.complifly.in Deliberately on the application domain, not the marketing one, so in-product links and public links are the same URLs
Product documentation docs.complifly.in This portal. On the application domain, so a reader trusts one registration rather than two
Status page status.complifly.tech Hosted separately so it survives an application outage
Marketing www.complifly.info Never link a signed-in user here
File downloads files.complifly.online Reserved, not in use in this release — PDFs are returned directly by the API today

Each of these can be changed per environment through the settings in the next section. A non-production deployment should set its own hostnames rather than inherit Complifly's.

Which settings control the hostnames

The application server reads each hostname from an environment variable. An unset variable falls back to the Complifly hostname in the Default column — it does not fail. On any deployment other than Complifly's own, set the ones that have an effect.

Variable Default What it changes in this release
DOMAIN_API https://api.complifly.in The ERP consent callback address, when ERP_CONSENT_REDIRECT_URI is not set
DOMAIN_HELP https://help.complifly.in Help Centre links in Compass answers
DOMAIN_DOCS https://docs.complifly.in Links to this portal in Compass answers
DOMAIN_APP https://app.complifly.in Nothing yet
DOMAIN_STATUS https://status.complifly.tech Nothing yet
DOMAIN_MARKETING https://www.complifly.info Nothing yet
DOMAIN_FILES https://files.complifly.online Nothing yet
CORS_EXTRA_ORIGINS none Nothing yet
DOMAIN_TUNNEL none Nothing yet

"Nothing yet" means the server reads the value at start-up but no feature uses it in this release. Setting it is harmless.

Three settings that look related are separate, and they are the ones that matter most:

Setting Controls
CORS_ORIGINS The only list of browser origins allowed to call the API. None of the variables above feed it, so a front-end hostname must be added here explicitly
APP_BASE_URL The application address in links inside emails the system sends. Defaults to http://localhost:8080
ERP_CONSENT_REDIRECT_URI The ERP consent callback, overriding the DOMAIN_API fallback. It must match the redirect URI registered in your identity provider character for character

Defaults for all of them are in the Environment Variables reference.

File downloads: today, and the planned design

Today, downloads are same-origin. Generated PDFs — e-invoices, e-Way Bills, exports — are returned directly by the API to the signed-in browser, authenticated the same way as any other API call. No separate hostname, certificate, CSP entry or proxy rule is needed for downloads in this release.

A different design is planned, and is not built yet. complifly.online and DOMAIN_FILES are reserved for a future design in which generated files are served from a separate origin on signed, time-limited links, with the session cookie deliberately excluded. If that ships in a later release, the two consequences below will apply, and this page will be updated to say so. They do not apply today:

  • The session cookie would not be sent there. Download links would need to be signed and time-limited rather than session-authenticated.
  • The download origin would need to be allowed explicitly in the content-security policy's connect and frame directives.

Until then, treat files.complifly.online as reserved, not reachable — do not configure a certificate, firewall rule or CSP entry for it.

The rule: never hardcode a hostname

No URL the product emits should carry a hardcoded hostname; each comes from configuration. In this release that configuration is spread across several settings: email links — password reset, e-Way Bill expiry and ERP sync alerts — come from APP_BASE_URL; allowed browser origins come from CORS_ORIGINS; Compass links and the ERP consent callback come from the hostname settings above. The API does not send a content-security policy, so the one described below must be set where the front end is served.

Hardcoding a hostname anywhere produces a defect with a characteristic shape: it works in the environment it was written for and silently points at the wrong environment everywhere else. A password-reset email from a test environment linking to production is the version of this failure that reaches a customer.

Certificates

Requirement Detail
A certificate per published hostname Or a wildcard covering them, per your policy
Complete chain served Browsers repair a missing intermediate; ERP integrations do not. Test with a tool, not a browser
Trusted publicly Any ERP calling in must trust it
Renewal automated and owned A named owner and a mechanism, not a calendar entry
Expiry monitored See Monthly Checks

Content-security policy inputs

Enumerate these before writing the policy:

Directive Must allow
Default and script sources The application origin
Connect sources The API origin. Add the download origin only if the planned separate-download design (above) is ever activated — not needed today
Frame sources The application origin, for inline previews. The download origin only under the planned design
Image sources The application origin, and any origin serving logos
Style and font sources The application origin, plus any font service in use

Omitting the API origin from connect sources is the most common cause of "downloads do not work" in this release.

Validation

Check Method Pass condition
Every hostname resolves Resolve each from a client network Correct address returned
Certificates valid Open each hostname in a browser Valid, trusted, not near expiry
Chain complete Test with an external TLS checker Full chain served
Application reachable Sign in Loads
API reachable Health request through the proxy HTTP 200
Downloads work Generate and download a document File downloads successfully
Links point at the right environment Trigger a password reset in each environment Each links to its own environment, never to another
Printed references correct Print a document and inspect any URL on it Correct environment
Content-security policy complete Load every main screen with the browser console open No policy violations reported

The expiry check is worth running deliberately. A download URL that never expires is a shareable, permanent, unauthenticated link to a customer's compliance document.

Troubleshooting

Symptom Cause Action
Downloads fail with no clear error API origin missing from the content-security policy Add it to connect sources
Download returns unauthorised Same as any other API call — expired or missing session/token Check the session, not the origin; downloads are not cross-origin in this release
Password-reset email links to the wrong environment APP_BASE_URL is wrong or unset — unset falls back to http://localhost:8080 Set APP_BASE_URL for that environment
ERP integration fails TLS while browsers are fine Incomplete certificate chain Serve the full chain
Help centre unreachable from inside the product Help hostname not configured, or blocked by policy Help is on the application domain; confirm it is reachable and allowed
Site unreachable overnight Certificate expired Automate renewal; monitor expiry
Some assets blocked in the browser console Content-security policy too narrow Enumerate the real origins and widen precisely — never to a wildcard
Moving a surface to a new hostname breaks links Hostnames hardcoded rather than configured Fix the configuration; this is exactly the failure the rule prevents
Strict transport security blocks a hostname change The header is cached in browsers Expected. Plan hostname changes with the header's lifetime in mind