Buy a domain and connect it to WebPortico

Your site, your NAS, your own name on the internet. WebPortico identifies who runs your domain’s DNS, tells you what to set there, and with an API key writes the records itself. No guessing which record goes where.

What you need

• A QNAP NAS with an Intel or AMD processor (x86_64), QTS 6.0 or QuTS hero 6.0 or later, and WebPortico from the QNAP Utilities repository in App Center.
• A public IPv4 address on your internet connection, with TCP ports 80 and 443 forwarded to the NAS. On Front server and ports, the Port forwarding on the router card requests these forwards through UPnP, NAT-PMP or PCP, or manages a UniFi gateway with its API key. On any other router, set the two forwards by hand.
• Ports 80 and 443 on the NAS belong to WebPortico. On Front server and ports, Take over ports 80 and 443 moves QTS’s servers to other ports.

Without a public address, use a Cloudflare Tunnel to publish the sites. See the hosting guide for instructions.

1. Start with the domain

In Sites, click Add site. The first step, Domain, asks: Do you have a domain for this site?

• Yes: type the name. WebPortico looks it up in the next step.
• No, I want to buy one: follow the panel’s buying instructions.
• No, the site is for my local network only: the wizard skips the DNS step.

You cannot change the site’s name later. For a public site, leave Also www. ticked. It adds the www name to the same site.

2. Buy a domain

Any registrar works. The panel’s steps show OVHcloud, because WebPortico can also write the DNS records there with an API key.

1. Search for the name on the registrar’s site and add it to the cart.
2. Skip hosting, mailboxes and other add-ons: the site runs on your NAS.
3. Sign in or create an account, check the contact details and pay.
4. The domain renews every year until you turn renewal off at the registrar.

Back in WebPortico, type the name and click I bought it. Until the registrar finishes the order, the registry lists no DNS servers for the name. The next step reports this and offers Check again.

3. WebPortico looks the domain up

Click Next to open the DNS step. WebPortico queries the registry for the name and shows the Domain, Registrar, DNS servers and DNS hosting, the service that answers for the domain’s names. The result determines the next options:

• OVHcloud or Cloudflare: create an API key or add the listed records by hand;
• TurboDNS on this NAS: set the listed name servers and glue records at the registrar;
• another provider: add the listed records there or move the whole domain to TurboDNS;
• a name that is not registered: check the spelling or follow the buying instructions.

4. DNS at OVHcloud

Choose WebPortico adds them with API keys and your OVHcloud region (Europe for an account created at a European OVHcloud site). Then:

1. Open Create API Keys from the step and sign in to OVHcloud. The link already holds the rights WebPortico needs for this domain.
2. Application name: WebPortico. Application description: DNS records for my sites.
3. Validity: Unlimited. A key with an end date stops working on that day, and WebPortico can no longer change the records.
4. Rights: one row for each line the step lists, the method on the left and the path on the right.
5. Restricted IPs: your public IPv4 address, or empty if your internet provider changes it.
6. Click Create and copy the three keys into Application key, Application secret and Consumer key.

Click Check and save. WebPortico checks the keys against the domain and stores them where only the panel’s account and root can read them. It never shows them again.

To add the records by hand, choose I add them myself in the OVHcloud Control Panel. The step lists the records to add in the domain’s DNS zone.

5. DNS at Cloudflare

Choose WebPortico adds them with an API token and create the token:

1. Open API Tokens and sign in.
2. Click Create Token, then Use template next to Edit zone DNS.
3. Under Permissions, keep Zone · DNS · Edit and add Zone · Zone · Read.
4. Under Zone Resources, pick Include · Specific zone and your domain.
5. Optional: under Client IP Address Filtering, enter your public IPv4 address. Skip this if your internet provider changes that address.
6. Click Continue to summary, then Create Token, and copy the token. Cloudflare shows it only once.

Paste the token into API token and click Check and save. WebPortico writes the records as DNS only. With Cloudflare’s proxy on, the name would return Cloudflare’s addresses, so the panel’s check could not see your NAS behind them. To add the records by hand, choose I add them myself in the Cloudflare dashboard. The step lists the records to add there.

6. DNS on your NAS: TurboDNS

With TurboDNS on this NAS, set the listed name servers at your registrar. Also set the listed glue record for each name server inside the domain. TurboDNS gets the zone’s records when you apply the site.

7. Another DNS provider

At any other provider, add the listed records where the domain’s DNS is managed, usually the registrar’s DNS page. These are an A record for the name, an AAAA record when the NAS has an IPv6 address, and a CNAME for www. Choose the other option to move the whole domain to TurboDNS on your NAS.

8. Finish the site

Continue through Website (static files, PHP or reverse proxy), PHP for a PHP site, Database, Certificate and Review. Choose Let’s Encrypt for the certificate. After you apply the site, WebPortico requests it from the site’s checklist.

On Review, click Preview changes. With a key, the list names each record WebPortico adds, replaces or removes at the provider. WebPortico never changes a CNAME on the site’s name. Click Apply changes to start the site and write the records.

9. Check it from the outside

In the checklist on the site’s Overview, click Check now to ask public DNS servers whether the names point at your NAS. A DNS change can take hours to reach all of them. When the names answer, click Request certificate. WebPortico gets the certificate from Let’s Encrypt and renews it no later than 30 days before it expires. If the provider refused a record, click Send records to try again. Close the checklist when the domain works.

10. Later: DNS and mail from the site’s page

Once the site exists, its page has a DNS tab and a Mail tab (WebPortico 0.27.0 or later). DNS shows the records of the zone that holds the site’s name: from TurboDNS on this NAS, or from Cloudflare or OVHcloud through the key you saved. Add record or a row’s pencil opens a record, and Review changes then shows what will change; a row’s bin shows the same list for deleting that record. Apply changes writes only what the list shows. TurboDNS checks each change with its own rules and keeps a copy of the zone from before it. With TurboDNS the tab also shows whether the zone is signed with DNSSEC and, when it is, the DS record for your registrar.

A site added later, or a new name added to a site, gets its records the same way without the wizard (WebPortico 0.27.1 or later). Preview changes lists the A and AAAA records the change needs in a zone WebPortico can write: TurboDNS on this NAS, or Cloudflare or OVHcloud with a saved key. Apply changes writes the site first, then the ticked records. A name that already has a CNAME or points to another server is left as it is, and the list says so. When you delete a site, its records are offered for removal, unticked. When WebPortico cannot write the zone, the list and the site’s DNS tab show the records to add and where the zone is kept.

Mail shows the domain’s mailboxes in MailServerPro with their use and quota, its aliases, the DKIM record to publish and the last deliverability check. New mailbox and New alias add them, and a mailbox is deleted only after you type its address. Open TurboDNS and Open MailServerPro open their own panels at this domain. The tabs need TurboDNS 1.5.0 and MailServerPro 0.6.5 or later; when one is missing or older, the tab says what to install or update.