Domain and certificate

Sprig serves the admin host, gateway, and published applications below one apps domain. The installer creates an Azure DNS zone for that complete domain and uses Acmebot to issue and renew one wildcard certificate through DNS validation.

Delegate the apps domain from its parent DNS zone to the Azure name servers printed by the first installation. The delegation remains unchanged across upgrades.

The first installation creates the DNS zone and prints its name servers. If the domain was not already delegated, add those records and rerun the same installation command. Installation then converges the platform, gateway, certificate binding, and Admin UI together; a separate deploy command is not required to make the Admin UI reachable.

Use --acme-env production during installation for a browser-trusted certificate. Use staging only for certificate-flow rehearsal because browsers do not trust staging certificates. Acmebot remains deployed after installation and renews the certificate automatically.

For complete removal, certificate export, or soft-deleted vault handling, follow Teardown.