Skip to main content

Domain & Routing

Every app on your PCS gets a public URL automatically. This page explains how domains are structured, how requests are routed, and what options you have.

Domain shape​

All Yundera domains follow this pattern:

{subdomain}.{user-domain}.{server-domain}

Example: immich.john.nsl.sh

  • immich — the app name (subdomain)
  • john — the user's namespace
  • nsl.sh — the server domain

How a request is routed​

  1. A visitor opens immich.john.nsl.sh in their browser.
  2. DNS resolves the domain to the NSL.SH network.
  3. The mesh-router backend verifies the request using a cryptographic signature (libp2p).
  4. The request reaches your PCS, where the local mesh-router resolves the subdomain to the correct Docker container.
  5. The container responds, and the page loads.

Three ways to reach your PCS​

Your PCS can be reached through different address types, each with different properties:

Address typeShapeExampleHow it works
sslip.io (direct){dashed-ip}.sslip.io203-0-113-42.sslip.ioDNS resolves the IP from the hostname itself. One TLS session, terminated on your PCS.
nsl.sh (managed){app}.{user}.nsl.shimmich.john.nsl.shNSL.SH handles DNS and routing. A dedicated certificate secures the connection.
Custom domainYour own domainphotos.example.comYou point your domain at your PCS (via Cloudflare or a direct A record).

For the privacy implications of each mode, see TLS & Privacy.

The transport layer: direct vs tunnel​

The actual traffic to your app (the data plane) takes one of two paths, depending on your network:

  • Direct route — when your PCS is directly reachable from the internet (public IP, ports open), traffic flows straight to your machine. The NSL.SH gateway is not in the path.
  • WireGuard tunnel — when your PCS is behind CGNAT or a restrictive network (no public IP, no port-forwarding), traffic travels through an encrypted WireGuard tunnel via NSL.SH infrastructure. The tunnel is encrypted, but the tunnel endpoint can see traffic in transit.

In both cases, your data at rest always stays on your machine.

Custom domains​

You can point your own domain at your PCS. See the Custom Domain Guide for step-by-step instructions.