# adom.cloud — DNS Proxy Service

Turn long, secret container URLs into short, memorable `*.adom.cloud` addresses. The secret container hash is completely hidden from end users.

## What It Does

Every Adom container has a URL like:
```
https://coder.john-project-a1b2c3d4e5f6g7h8.containers.adom.inc/proxy/8797/
```

The long hash in the URL acts as authentication — anyone with it can access your service. But it's ugly and hard to share. **adom.cloud** lets you create clean URLs like:

```
https://myapp.adom.cloud
```

That reverse-proxy to your container service, hiding the secret hash entirely.

## How It Works

```
Browser → myapp.adom.cloud → Cloudflare DNS (proxied) → CF Worker → KV Lookup → Container URL
```

1. **DNS** — A proxied A record points `myapp.adom.cloud` to a dummy IP (`192.0.2.1`)
2. **Cloudflare Worker** — Intercepts the request before it reaches the dummy IP
3. **KV Lookup** — Worker reads the subdomain from the Host header, looks up the target URL in Cloudflare Workers KV
4. **Reverse Proxy** — Worker fetches from the real container URL and returns the response to the user

Both HTTP and WebSocket connections are proxied transparently — important for VS Code, Adom Viewer, and other real-time apps.

## Features

- **Edge Performance** — Cloudflare Workers run at 300+ edge locations worldwide, sub-50ms latency
- **Automatic SSL** — HTTPS is free and automatic via Cloudflare
- **WebSocket Support** — Full bidirectional WebSocket passthrough for real-time apps
- **Hidden Secrets** — The container hash never appears in the user's browser
- **Instant Provisioning** — Create a subdomain in seconds via Claude

## Usage

Just ask Claude:

- *"Create a subdomain called myapp for my viewer on port 8797"*
- *"Set up editor.adom.cloud to point to my VS Code on this container"*
- *"List all my adom.cloud subdomains"*
- *"Delete the test subdomain"*

Claude handles all the Cloudflare API calls — DNS record creation, KV mapping, and verification.

## Subdomain Rules

- Lowercase letters, numbers, and hyphens only
- 1–63 characters
- Cannot start or end with a hyphen
- Reserved names blocked: `www`, `api`, `mail`, `admin`, `dashboard`, etc.

## Architecture

| Component | Details |
|-----------|---------|
| **Domain** | `adom.cloud` (registered on Cloudflare) |
| **Worker** | `adom-dns-proxy` — routes `*.adom.cloud/*` |
| **KV Store** | `DNS_MAP` namespace — subdomain → target URL mappings |
| **DNS Records** | Proxied A records → `192.0.2.1` (RFC 5737 dummy IP) |
| **Source** | `gallia/dns/` (Worker in `worker/`, provisioning service in root) |

## Security

- The adom.cloud URL becomes public — anyone with it can access the service
- The secret container hash is never exposed to end users
- SSL termination at Cloudflare edge
- Credentials stored securely in `~/.claude/skills/adom-cloud/.env` (never committed to git)