Make the instance reachable
Give your instance a stable HTTPS address
Publish the control plane from onboarding, then verify the address your agent client will use for MCP and OAuth.
An HTTPS origin that serves your login and advertises OAuth for /mcp.
On this page
1. Choose how to publish
After claim, continue to the onboarding step titled Publish this GroundControl instance on a Linux server installation. Desktop installations remain local; this publishing flow is for servers. Choose a method appropriate for the host and DNS you control.
| Option in GroundControl | Use it when | Result |
|---|---|---|
| I have a domain | Your hostname resolves to this VPS and Caddy can serve it | A durable HTTPS origin |
| Use Cloudflare Tunnel | Your domain is on Cloudflare and you want a private origin | A named outbound tunnel |
| No domain yet | You need a temporary evaluation endpoint | A temporary trycloudflare.com URL |
| Keep it private | You only need local or SSH access | No externally reachable MCP endpoint |
The named-domain routes are the durable setup. A temporary tunnel hostname can change, requiring you to reconnect the MCP client. The clean-host acceptance test covers private installation; it does not certify every DNS and tunnel provider.
2. Publish with your domain
- Select I have a domain.
- Enter your hostname, for example
gc.example.com, in GroundControl hostname. - Choose Publish & verify. If DNS is not ready, the page shows the exact A record to create with your DNS provider.
- Add that record, wait for it to resolve, then choose Publish & verify again.
- Open the returned Management URL and confirm that your GroundControl login loads over HTTPS.
On hosts with an existing proxy, review who already owns ports 80 and 443 before choosing the Caddy route. An existing reverse proxy can forward the hostname to the loopback service. Do not start a second edge proxy on those ports.
Or use a Cloudflare Tunnel
- Select Use Cloudflare Tunnel and enter the hostname.
- If the connector is not configured, provide a Cloudflare API token with Tunnel and DNS access in the product’s password field. Supply the account ID if the token can access more than one account.
- Choose Publish & verify. GroundControl creates or reuses a named tunnel and updates the DNS route.
- Open the resulting Management URL. The host’s management port remains on loopback.
To evaluate without a domain, choose No domain yet → Create temporary HTTPS. Treat that URL as temporary identity, not a permanent OAuth issuer.
3. Verify OAuth discovery
Replace the example host below with your actual HTTPS origin. Run this from a machine outside the VPS so you test the public path.
curl -fsS https://gc.example.com/.well-known/oauth-protected-resource
curl -fsS https://gc.example.com/.well-known/oauth-authorization-serverBoth requests should return JSON, not a login page or proxy error. The resource should identify your HTTPS /mcp endpoint; issuer and authorization URLs should use the same public host. A bare unauthenticated request to /mcp may return 401 to start discovery. That response alone does not indicate a fault.
If you see HTTP, localhost, or an old hostname in metadata, fix public-origin/proxy configuration before adding the plugin. Continue to connect one deployment.