Deployment

This page describes CertWatch's own hosting for context — it isn't a guide to deploying CertWatch yourself; there is no self-hosted distribution today.

The product

CertWatch runs on Fly.io. The marketing site (certwatch.sh) and the authenticated app (app.certwatch.sh) are one deployment that renders differently by hostname. Keeping those two product surfaces together avoids a second auth, cookie, CORS, and preview boundary while they share the same API and release cadence. A separate scheduled process runs the actual TLS/domain checks and alert delivery. Every change goes through an ephemeral per-pull-request preview environment before reaching production.

This docs site

docs.certwatch.sh (issue #220) is an intentionally separate, independently built and styled static site - its own directory (docs-site/) in the CertWatch repository, with its own build and test commands, not bundled into the app's frontend build. That separation is deliberate: documentation should not share a deploy pipeline, an outage, or a release cadence with the product it's documenting. It is hosted on Cloudflare Pages as the certwatch-docs project, with no database, API, authentication, or checker process.

Current status: production is served at docs.certwatch.sh through Cloudflare Pages. Merges to master that change docs-site/ run the docs tests and build, then publish the generated site through the repository's Cloudflare deployment workflow. The product's staging and preview hosts intentionally use the production docs site until a separate docs environment is justified.

Releases

The product ships through pull requests merged to a shared integration branch, then promoted to production via a short-lived release branch — every change is reviewed, tested, and deployed to a preview environment before it reaches real accounts.