Get API key
Last updated

Apexly reliability: what keeps serving, status and support

What happens to your customers' domains when something fails, said plainly: what keeps serving, what pauses, how you hear about it, and what we do not promise yet.

How is Apexly built?

Two parts that fail separately:

  • The edge serves your customers' domains: it terminates HTTPS, finds the route for the hostname and forwards the request to your origin with a signature.
  • The control plane is everything else: the API, the dashboard, the connect page, DNS checks, certificate orders, webhooks and email.

The edge keeps its own copy of every route in memory and saves it to disk every minute. It takes a full snapshot from the control plane at start and every hour, and picks up changes in between over a private, mutually authenticated TLS connection. Certificates live in shared storage on AWS S3, so the edge can load them without the control plane.

Where it runs today: one AWS region, Mumbai (ap-south-1), on one server. The edge and the control plane run in separate containers there, and the edge has its own IP address. Apexly routes and secures traffic; it is not a CDN and does not cache.

What keeps working if the API is down?

Keeps working

  • Every live domain keeps serving HTTPS and forwarding signed requests to your origin.
  • Domains whose customer moved their DNS (dns_broken) keep serving their certificate, as they always do.
  • If the edge restarts during the outage, it loads its saved route table from disk and serves without the control plane.

Pauses until it is back

  • New domains: DNS checks, verification and certificate orders. The edge refuses hostnames it has no route for.
  • The API, the dashboard and the connect page.
  • Webhooks: each one is saved when the state changes and delivered once the workers are back.
  • Route changes, such as a new origin or a deleted domain, reach the edge when the control plane returns.

How do certificates renew, and what if they fail?

  • Certificates come from Let's Encrypt, only for hostnames we have verified, never on a guess.
  • Orders are spread across three Let's Encrypt accounts by hostname, so one account's rate limit does not stall every new domain.
  • Certificates last 90 days and renew from day 60, so 30 days before expiry. A renewal fires domain.certificate_renewed.
  • If the certificate authority refuses an order, or it does not finish within 10 minutes, the domain moves to cert_failed with the reason, often a CAA record, and the record to add. We retry automatically after 1 minute, 5 minutes, 30 minutes and 2 hours, then every 12 hours, and email you after the third failed attempt.

Private keys stay in encrypted storage, never in a database or a log.

What health checks and alerts do I get?

  • DNS. Live domains are re-checked every 6 hours against 1.1.1.1, 8.8.8.8 and the domain's own nameservers. If a customer's record moves, the domain goes to dns_broken and you get a webhook naming the record.
  • Your origin. Probed every 15 minutes. After three failures in a row it is flagged as unreachable in the dashboard and in GET /v1/apps/current.
  • Webhooks. 9 signed event types, one per state change, in order per domain. Anything but a 2xx is retried 7 times: after 1 minute, 5 minutes, 30 minutes, 2, 6, 12 and 24 hours. Every attempt is listed in the dashboard and in GET /v1/events, and POST /v1/events/{id}/redeliver sends one again.
  • The domain doctor. GET /v1/domains/{id}/diagnose runs every check now and names the one thing to fix. See the domain doctor guide.

Where is the status page?

status.apexly.dev shows the API, the dashboard, the docs, the website and the edge that serves custom domains, each with its uptime history, plus incidents and maintenance. It is hosted by Better Stack, not on our server, so it stays up when we do not.

How does support work, and is there an SLA?

  • Email support@apexly.dev. During launch, Vijay, the founder, answers support email himself.
  • There is no published response time yet. A hostname held for abuse review is looked at by a person within one business day.
  • No contractual SLA yet. During launch Apexly runs without a service-level agreement unless we sign one with you in writing. Enterprise can include a custom SLA.

Planning for the worst case? The exit plan shows how to export your domains and move them elsewhere.

Questions

What happens to my customers' domains if Apexly's API goes down?
They keep serving. The edge that terminates HTTPS and forwards requests is a separate service with its own copy of every route, saved to disk, and certificates in shared storage, so live domains keep working without the API. New domains cannot go live, the dashboard and connect page are unavailable, and webhooks wait until the API is back.
Is Apexly multi-region?
Not yet. Apexly runs in one AWS region today, Mumbai (ap-south-1), on one server, with the edge and the API in separate containers.
Does Apexly have an SLA?
No contractual SLA yet. During launch the service runs without a service-level agreement unless we sign one with you in writing. Enterprise plans can include a custom SLA.
When are certificates renewed?
From day 60 of a 90-day Let's Encrypt certificate, so 30 days before it expires. That leaves a month of margin for retries. Each renewal fires a domain.certificate_renewed webhook.
How will I know if something breaks?
Every state change fires a signed webhook with a reason and a fix: a customer's DNS moving fires domain.dns_broken, and a certificate that cannot be issued or renewed fires domain.cert_failed. Your origin is probed every 15 minutes and flagged as unreachable after three failures in a row. Webhooks retry seven times over about 45 hours.
Are my customers' hostnames public in Certificate Transparency logs?
Yes, as with any HTTPS site. Every publicly trusted certificate, from any certificate authority or provider, is published in public Certificate Transparency logs, and the hostname on it becomes public. That is how browsers catch mis-issued certificates, and it is not specific to Apexly. Apexly gets one certificate per hostname, never a wildcard, so each customer hostname appears in the logs when its certificate is issued. Keep secrets out of hostnames.
How do I reach support?
Email support@apexly.dev. During launch the founder answers support email himself. There is no published response time yet; a hostname held for abuse review is looked at by a person within one business day.