# Domains

Every branch with an [`edge`](https://docs.omniarc.eu/reference/arc-yaml/edge.md) has a public address of its own, made for it, over HTTPS. You can also serve a branch at a domain you own, next to that address. OmniArc issues and renews the certificate.

## Bind a domain

```sh
omniarc arc domain add shop production shop.example.com
```

The arguments are the arc, the branch, and your domain; put your own in place of `shop.example.com`. It needs a key with the `owner` role. It prints the two DNS records to create at your DNS provider:

```text
shop.example.com (waiting_for_records)
create these DNS records:
shop.example.com  CNAME  <hex>.arc.omniarc.eu
_acme-challenge.shop.example.com  CNAME  <hex>.acme.arc.omniarc.eu
```

The first sends visitors to the branch's own address, the one `omniarc arc branch url` prints. The second lets OmniArc prove to the certificate authority that it may issue a certificate for your domain, now and at every renewal.

Create both. They are checked every five minutes. Once they are found the domain moves to `cert` while its certificate is issued, then to `ready`, and it serves.

## Watch it

```sh
omniarc arc branch url shop production
```

Prints the branch's own address, then each of its domains with its state and records, and, while one waits, what its names resolved to at the last check.

## What can be bound

- A subdomain, such as `www.example.com` or `shop.example.com`. A bare `example.com` cannot be: a CNAME cannot sit at the top of a domain.
- Any branch, not only production: `staging.example.com` on a `staging` branch works the same way.
- Up to 15 domains on one branch.
- A domain is bound to one branch at a time.

## Remove a domain

```sh
omniarc arc domain remove shop production shop.example.com
```

The branch's own address keeps working. Delete the two DNS records afterwards.

**Example: shop/arc.yaml**

```yaml
arc: shop
edge: { service: web, port: 3000 }
resources: { cpu: "1", memory: 1Gi, disk: 5Gi }
services:
  web:
    kind: web-service
    contains_pii: false
  db:
    kind: database
    contains_pii: true
    anonymize:
      engine: postgres
      database: shop
      user: shop
      rules:
        - { table: customers, column: email, transform: fake-email }
```