Custom domain and HTTPS

Set up HTTPS on your own domain and update calendar links, MCP clients and sign-in credentials after moving.

1. Choose a domain and configure the route or reverse proxy below for your deployment.
2. Set SITE_URL to https://calends.example.com and redeploy or recreate the container.
3. Sign in through the new domain and check HTTPS, passkeys, calendar links and MCP access.

Cloudflare

Add routes to wrangler.jsonc to attach the domain to the Worker as a custom_domain. The domain must already be on your Cloudflare account:

"routes": [{ "pattern": "calends.example.com", "custom_domain": true }],

Then deploy again:

npm run deploy

Cloudflare creates the DNS record and certificate for you. Adding a custom domain in the Worker’s dashboard settings does the same.

Also set SITE_URL in vars to the new domain; see Configuration.

Docker

Calends itself only speaks HTTP. On the public internet, put it behind a reverse proxy that handles HTTPS, and set TRUST_PROXY=1 on the container.

Caddy (gets certificates automatically):

calends.example.com {
  reverse_proxy 127.0.0.1:8787
}

Nginx:

server {
  listen 443 ssl;
  server_name calends.example.com;
  # ssl_certificate / ssl_certificate_key ...

  location / {
    proxy_pass http://127.0.0.1:8787;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }
}

The built-in assistant’s streaming responses carry an X-Accel-Buffering: no header, so Nginx doesn’t buffer them and replies appear as they’re written.

For use on your own machine or LAN only, you can open http://<IP>:8787/admin directly. Browsers only allow passkeys over HTTPS or on localhost, so via an IP you’ll sign in with your password.

When changing domains

• Passkeys are tied to the domain and won’t work on the new one. Sign in with your password, then add new ones under Settings → Security.
• Calendar feed and reminder links use your site address. If you set SITE_URL, change it; if not, open the app once on the new domain. Calendars you’ve already subscribed need the new link.
• MCP clients need the new address; tokens stay the same.
• Your data isn’t affected.