# DNS and web server / DNS และเว็บเซิร์ฟเวอร์

wxch does not manage DNS. You own the domain; wxch only needs a few names that point at your server.
wxch ไม่จัดการ DNS ให้ คุณเป็นเจ้าของโดเมน wxch ต้องการแค่ไม่กี่ชื่อที่ชี้มาที่เซิร์ฟเวอร์

## Names wxch needs

Add one **A record** per name, pointing at the public IP of your server (add `AAAA` too if it has IPv6):

| Name | Purpose |
|------|---------|
| `control.example.org` | web terminal and machine control, installer (`/get`) |
| `api.example.org` | OpenAI-compatible gateway |
| `chat.example.org` | web chat |
| `notepad.example.org` | shared notepad (a clipboard between devices) |
| `note.example.org` | plans and design notes (`/doc/<name>`) with a box for suggestions; web password (optional) |
| `studio.example.org` | images, video and transcripts from the AI modules (optional) |
| `talk.example.org` | messages between AI agents on different machines; API keys with the "talk" scope (optional) |
| `comfy.example.org` | ComfyUI's own page for the administrator, carried to the machine over its agent connection (optional; web password + 2FA) |

All of them are served by the same `wxch-server`, which tells them apart by the first label of the host name. Use fewer if you do not need a page: only `control` is required.

## HTTPS

Use [Caddy](https://caddyserver.com): it gets and renews certificates by itself. Install it, then:

```
/etc/caddy/Caddyfile            import /etc/caddy/sites/*.caddy
/etc/caddy/sites/wxch.caddy     copy of deploy/server/wxch.caddy.example with your domain
```

`sudo systemctl reload caddy` after changing a file. DNS must already resolve before Caddy can get a certificate
(the first start fails with a certificate error otherwise: wait a few minutes and reload).

## Other things on the same domain

Anything that is not wxch (a git server, a camera page, a blog) is not part of this project and is not kept in this repository.
For each new name, for example `photos.example.org`:

1. add an **A record** for it
2. add `/etc/caddy/sites/photos.caddy`, for example:
   ```
   photos.example.org {
       reverse_proxy 127.0.0.1:2283
   }
   ```
3. `sudo systemctl reload caddy`

Avoid a wildcard record (`*.example.org`): every misspelled name would reach your server, and a wildcard certificate
needs a DNS-provider plugin. Adding one record per service is simpler and safer.

## Login

The web password is the only thing between the internet and a shell on your machines. Use at least 12 characters
(the server enforces it), change it from the web UI after the first login, and keep it out of chat logs.
Repeated wrong passwords lock the address for 15 minutes. Two-factor codes are optional: create the server
config with `wxch-server -init -totp` to turn them on (existing installs: add a `totp_secret` to `config.json`).