Custom Domains & WAF

Custom domains

Add custom domains with automatic SSL certificate provisioning via ACM and DNS validation via Route 53.

# Add a custom domain (provisions ACM cert + Route 53 records)
keel domains add api.example.com

# List configured domains
keel domains list

# Remove a custom domain
keel domains remove api.example.com

You can also declare domains in keel.yml:

domain:
  name: api.example.com
  zone: example.com

WAF

Keel supports AWS WAF with managed rule sets to protect your ALB. WAF requires a load balancer (mode: advanced or load_balancer.enabled: true).

Enable it in keel.yml:

waf:
  enabled: true
  managed_rules:
    - AWSManagedRulesCommonRuleSet

Or manage it from the CLI (admin access; run keel up afterward to apply):

# Enable WAF with the common managed rule set (default)
keel waf enable

# Enable with specific managed rule groups
keel waf enable --rules AWSManagedRulesCommonRuleSet,AWSManagedRulesSQLiRuleSet

# Show current WAF configuration
keel waf status

# Disable WAF
keel waf disable

When enabled, Keel provisions a WAF Web ACL attached to your ALB with the selected AWS managed rule sets. Changes are applied on the next keel up.