=======
Domains
=======

Eyrie manages subdomains and ingress rules so that every deployment is
reachable via a unique URL.

Project Domain
==============

Each project has a **base domain** configured in project settings. All
deployment subdomains are generated under this domain.

Deployment Subdomains
=====================

When a deployment is created, Eyrie generates a subdomain based on:

- The **scope's root subdomain** (if configured).
- The deployment name and project slug.

For example, a deployment named "production" in project "my-company" might
receive ``production.my-company.example.com``.

Adding Custom Domains
=====================

1. Open the deployment detail page.
2. Navigate to the **Domains** tab.
3. Click **Add Domain** and enter the fully qualified domain name.
4. Point the domain's DNS to the cluster's load balancer IP or CNAME.

Eyrie creates an ingress resource and provisions a TLS certificate via
cert-manager.

.. image:: /static/img/subdomain_list.png
   :alt: TODO — screenshot of the subdomain list

.. image:: /static/img/add_domain_dialog.png
   :alt: TODO — screenshot of the add domain dialog

IP Restriction and Role-Based Ingress
======================================

Deployments can restrict access by:

- **IP allowlist** — only specified IP ranges can reach the ingress.
- **Role-based ingress** — require a minimum project role to access the
  deployment URL.

Syncing Ingresses
=================

Click **Sync Ingress** to reconcile the Kubernetes ingress resources with the
current subdomain and domain configuration. This runs the
``deployment_sync_ingress_book_id`` Deployment Book.