documentation

Domains & HTTPS

Any domain works — .test is only the default. Every domain gets a hosts entry, a locally issued TLS certificate trusted in your keychain, and an answer on bare https://name.test with no port suffix.

Domains

agent-local domain SLUG shop.example   # hosts entry and cert follow
agent-local suffix [.test]             # show or set the default suffix

Certificates

A certificate is issued the moment a domain is created or renamed, and trusted in the keychain automatically after the one-time agent-local sudo. That trust is scoped: the allowlist permits trusting one fixed, root-owned staging path and nothing else, so no other process can use it to trust an arbitrary certificate. Check on one with agent-local cert DOMAIN [--trust]; --trust shows the password dialog when the allowlist is not installed.

Bare URLs and port 80

Sites answer on :80/:443 through a front daemon bound to the loopback alias 127.0.0.2 — a specific address, which the kernel prefers over another app's wildcard bind. If something else must have the ports, hand them over briefly:

agent-local yield 60    # free :80/:443 for a minute; sites stay reachable on :1080

Sharing the machine with LocalWP: both can serve at once, because they bind different addresses. The one trap is LocalWP pre-checking port 80 and refusing to start — yield, start the site in Local, and both run side by side.