Multiple wildcard SSL domains and Appwrite

[ProfessorManhattan]

How to Automatically Forward *.appwrite.domain.com to appwrite.domain.com with SSL in Coolify?

Hey Coolify team and community

I'm currently hosting an AppWrite instance at appwrite.domain.com using Coolify, and it's working great with automatic SSL via Cloudflare and the wildcard domain setup for domain.com.

Now I want to take it a step further:

🔹 Goal

Automatically provision SSL for *.appwrite.domain.com (e.g., myproject.appwrite.domain.com) and have all these subdomains forward to the existing AppWrite app at appwrite.domain.com.

🔹 Current Setup

• Coolify is configured with domain.com as the wildcard domain.
• DNS is managed by Cloudflare.
• I'm using the Cloudflare DNS challenge for cert generation.

🔹 Problem

While appwrite.domain.com works out of the box, *.appwrite.domain.com doesn’t automatically get SSL provisioned.
I’d like to avoid having to manually touch the Coolify system more than once — ideally, everything should be automated from the dashboard or with one-time config changes.

🔹 Questions

1. What’s the best way to configure Coolify/Traefik so that *.appwrite.domain.com is automatically covered by a wildcard SSL cert?
2. Is there a way to have Coolify automatically provision the cert for *.appwrite.domain.com without manual DNS or system config tweaks each time?
3. Can I route *.appwrite.domain.com traffic to the appwrite.domain.com container without duplicating container definitions?

Would love to hear how others solved this — or if there's a recommended pattern for wildcard sub-subdomains like this under a single app!

Thanks in advance 🙏

[djsisson]

wildcard certs can only be obtained via a dns challenge or installing a certificate yourself, so you would need to add the relevant entries to your traefik config

https://doc.traefik.io/traefik/https/acme/#dnschallenge

since you are already using cf dns challenge, then just add the extra sni entry (see below)

please note, you can't use cloudflare dns proxy on 2nd level subdomains unless you pay

in regards routing wildcards, you can just add a hostregexp either as a set of labels or a dynamic file

http:
  routers:
    appwrite-wildcard:
      entryPoints:
      - http
      - https
      tls:
        certResolver: "letsencrypt"
        domains:
          - main: "appwrite.domain.com"
            sans:
              - "*.appwrite.domain.com"
      service: appwrite-wildcard
      rule: HostRegexp(`^.*\\.appwrite\\.domain\\.com$`)
  services:
    appwrite-wildcard:
      loadbalancer:
        servers:
          - url: http://appwrite:80

this is just an example, but would route all subdomains under appwrite.domain.com to the appwrite service

one last note, you will need to make sure your api key also has appwrite.domain.com as a zone otherwise you will not have permission to generate the required entry as well as ensure this subdomain entry exists in your cf dns.

[ProfessorManhattan]

Thanks for this. This seems to work at least partially. Now, I can publish a site at https://my-website.sites.appwrite.domain.com and the preview shows up in the browser but when I click on the link (which passes validation), I see ERR_SSL_VERSION_OR_CIPHER_MISMATCH. Does this mean I have to buy the custom certificate from CloudFlare?

[djsisson]

Check the proxy logs for details of error

But the cf advanced certificate manager is only $10 a month i think

Also each subdomain level is its own zone so you need to make sure the api key you use covers the zone

Ps the generated cf certs you can make for free are only valid going through the cf dns proxy, so you can't use them either for anything other than the apex domain and it's wildcard without paying , even though it will let you generate them.