On-demand TLS

[kevinmcconnell]

Allows applications to provision TLS certificates for multiple hosts on-demand, by way of an application endpoint that gates issuance on a host-by-host basis.

To use, specify --tls-on-demand-url rather than --host. The URL can be directed to an external service, or plain path routed to the service.

This is a port of #63, which had drifted a bit from main (and from autocert),

[Copilot]

Pull request overview

Adds an “On-demand TLS” mode to Kamal Proxy, allowing TLS certificates to be provisioned dynamically per-host via an HTTP endpoint (external URL or an internal path routed through the deployed service), rather than requiring a static --host list at deploy time.

Changes:

• Introduces a TLS on-demand host policy that approves/denies certificate issuance by probing a configured endpoint (with caching-aware short-circuiting).
• Extends service options, validation, and router state restore to support --tls-on-demand-url.
• Updates documentation and adds test coverage for URL parsing, probe behavior, and state restoration.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
README.md	Documents how to use on-demand TLS and what the probe request/response semantics are.
internal/server/tls_on_demand.go	Implements the on-demand TLS checker (local routing vs external HTTP endpoint).
internal/server/tls_on_demand_test.go	Tests URL validation, request construction, redirect handling, body truncation, and cache short-circuiting.
internal/server/service.go	Adds option wiring/validation and integrates host policy selection into autocert manager creation.
internal/server/service_test.go	Extends validation tests for TLS on-demand option combinations.
internal/server/service_map.go	Adjusts default TLS hostname selection logic.
internal/server/service_map_test.go	Adds coverage ensuring on-demand TLS services don’t affect default TLS hostname.
internal/server/router_test.go	Ensures state restore preserves the TLS on-demand host policy behavior.
internal/cmd/deploy.go	Adds --tls-on-demand-url CLI flag.
internal/cmd/deploy_test.go	Adds CLI pre-run validation tests for on-demand TLS flag interactions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[brendon]

Thanks for this :) Looking forward to giving it a try. I am struggling to figure out if there has been a version released with this change in it. How can one tell? :)

[kevinmcconnell]

Hi @brendon this isn't in a released version yet. I'm aiming to get a new version out soon, but I have a couple other features in-flight that I'd like to land first to go along with it. In the meantime if you're happy trying this from the main branch yourself, I'd love to hear how you get on!

[brendon]

Thanks @kevinmcconnell, I can give it a go. Is there anything special I need to do to use main?

[rafaelmontas]

Thanks for this! @did @kevinmcconnell