Domains & SSL

Roitrack serves two different things over HTTP, and you decide which domains serve which.

Domain roles

Role	Serves	Typical name
admin	The dashboard and the admin API	admin.yourdomain.com
tracking	Click links, hosted landers, and S2S postbacks	t.yourdomain.com, go.yourdomain.com

A single domain can hold both roles — that’s what a one-domain install does — but separating them is the usual setup. Tracking domains get burned by ad networks and blocklists from time to time, and when that happens you want to swap the tracking domain without losing access to your own dashboard.

You can add as many tracking domains as you like and pick one per campaign.

Point DNS first

Create the DNS record before adding the domain in Roitrack. Certificate issuance checks DNS immediately, and a domain added ahead of its DNS record will fail its first certificate attempt.

Adding a domain

1. Create an A record for the hostname pointing at your VPS IP.

2. Dashboard → Domains → Create. Enter the hostname, tick the roles it should serve, and choose an SSL mode (below).

3. Wait for the certificate. The domain list shows nginx status, certificate status, and expiry. A domain that fails shows the reason in its error column.

SSL modes

Let’s Encrypt

The default. Roitrack runs certbot on the host and issues a real certificate.

Requirements:

• The A record must already point at the VPS
• Port 80 must be reachable from the internet — the HTTP-01 challenge needs it, and it stays needed for renewals
• If the domain is on Cloudflare, the record must be DNS only (grey cloud), not proxied

Before the certificate exists, Roitrack installs a bootstrap nginx config that serves plain HTTP so the challenge can complete. Once the certificate is issued the config is rewritten with the full HTTPS template. This is why a brand-new domain is briefly HTTP-only — it’s expected, not a failure.

Renewal is automatic.

Cloudflare

Use this when the domain is proxied through Cloudflare (orange cloud). Cloudflare terminates TLS at its edge, so the origin only needs a certificate Cloudflare will accept.

Roitrack generates one shared self-signed certificate at /etc/nginx/cf-selfsigned.crt and reuses it for every Cloudflare-mode domain.

Set Cloudflare to Full, not Full (strict)

The origin certificate is self-signed. Full (strict) validates the origin certificate against a public CA and will fail with error 526. Use Full. Flexible also works but sends unencrypted traffic between Cloudflare and your VPS — don’t.

Cloudflare mode can also manage the DNS record for you. Supply a zone ID and an API token and Roitrack will create the A record itself, or adopt an existing record if one already points at your VPS with the same proxy setting. The Proxied toggle stays in sync with Cloudflare afterwards, so flipping it in Roitrack flips the orange cloud.

The API token needs Zone.DNS:Edit on that zone and nothing more.

Adding domains in bulk

Bulk add takes a list of hostnames and applies the same roles, SSL mode, and Cloudflare settings to all of them. Each domain is processed independently — one failure doesn’t stop the rest, and anything that failed shows its own error.

This is the fast path for rotating in a batch of fresh tracking domains.

Checking and fixing certificates

The domains list shows, per domain, whether nginx picked up the config, whether a certificate exists, and when it expires. Two actions are worth knowing:

• SSL check re-tests the live TLS handshake and refreshes the recorded expiry. Run it after changing anything at the DNS or Cloudflare layer.
• Issue certificate retries certbot for a single domain, then rewrites its nginx config.

When a certificate won’t issue

Work through these in order:

1. Does DNS point at this server? Check the A record at your DNS provider matches your server’s IP exactly. This is the cause most of the time.
2. Is it proxied when it shouldn’t be? Let’s Encrypt mode plus an orange cloud fails every time. Either grey-cloud the record or switch the domain to Cloudflare mode.
3. Is port 80 open? Check the VPS firewall and your provider’s cloud firewall separately — they’re two different things and both must allow it.
4. Did you hit a rate limit? Let’s Encrypt allows 5 failures per hostname per hour. If you’ve been retrying, wait an hour; further attempts fail regardless of whether the underlying problem is fixed.

Removing a domain

Deleting a domain removes its nginx config and reloads nginx. If Roitrack created the Cloudflare DNS record, that record is deleted too.

Campaigns still pointing at a deleted domain will stop resolving, so repoint them first.