Wildcard Subdomain

[caf-3]

Description

When users sign up for an application hosted on Coolify (e.g., at example.com), automatically create and configure a subdomain for them (username.example.com) without manual intervention.

Desired Behavior

1. Application owner configures a wildcard domain (*.example.com) in Coolify
2. When a new user signs up inside my system (for example):

• System automatically creates a subdomain based on their username (username.example.com)
• Routes traffic for that subdomain to the main application
• No manual intervention required from the application owner
• Subdomain becomes immediately active and accessible

Use Cases

1. SaaS applications wanting to provide branded subdomains to customers
2. Multi-tenant applications where each tenant needs their own subdomain
3. Portfolio platforms where users get their own space (username.example.com)
4. Blog platforms providing custom domains to writers

[Seym0n]

I achieved this through custom labels:

traefik.enable=true
traefik.http.middlewares.gzip.compress=true
traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
traefik.http.routers.http-0-xxxxxxxxxxxxxxxxxxxx.entryPoints=http
traefik.http.routers.http-0-xxxxxxxxxxxxxxxxxxxx.middlewares=redirect-to-https
traefik.http.routers.http-0-xxxxxxxxxxxxxxxxxxxx.rule=HostRegexp(`.*\.example\.com`)
traefik.http.routers.http-0-xxxxxxxxxxxxxxxxxxxx.service=http-0-xxxxxxxxxxxxxxxxxxxx
traefik.http.routers.http-1-xxxxxxxxxxxxxxxxxxxx.entryPoints=http
traefik.http.routers.http-1-xxxxxxxxxxxxxxxxxxxx.middlewares=redirect-to-https
traefik.http.routers.http-1-xxxxxxxxxxxxxxxxxxxx.rule=Host(`example.com`) && PathPrefix(`/`)
traefik.http.routers.http-1-xxxxxxxxxxxxxxxxxxxx.service=http-1-xxxxxxxxxxxxxxxxxxxx
traefik.http.routers.https-0-xxxxxxxxxxxxxxxxxxxx.entryPoints=https
traefik.http.routers.https-0-xxxxxxxxxxxxxxxxxxxx.middlewares=gzip
traefik.http.routers.https-0-xxxxxxxxxxxxxxxxxxxx.rule=HostRegexp(`.*\.example\.com`)
traefik.http.routers.https-0-xxxxxxxxxxxxxxxxxxxx.service=https-0-xxxxxxxxxxxxxxxxxxxx
traefik.http.routers.https-0-xxxxxxxxxxxxxxxxxxxx.tls.certresolver=letsencrypt
traefik.http.routers.https-0-xxxxxxxxxxxxxxxxxxxx.tls=true
traefik.http.routers.https-1-xxxxxxxxxxxxxxxxxxxx.entryPoints=https
traefik.http.routers.https-1-xxxxxxxxxxxxxxxxxxxx.middlewares=gzip
traefik.http.routers.https-1-xxxxxxxxxxxxxxxxxxxx.rule=Host(`example.com`) && PathPrefix(`/`)
traefik.http.routers.https-1-xxxxxxxxxxxxxxxxxxxx.service=https-1-xxxxxxxxxxxxxxxxxxxx
traefik.http.routers.https-1-xxxxxxxxxxxxxxxxxxxx.tls.certresolver=letsencrypt
traefik.http.routers.https-1-xxxxxxxxxxxxxxxxxxxx.tls=true
traefik.http.services.http-0-xxxxxxxxxxxxxxxxxxxx.loadbalancer.server.port=3000
traefik.http.services.http-1-xxxxxxxxxxxxxxxxxxxx.loadbalancer.server.port=3000
traefik.http.services.https-0-xxxxxxxxxxxxxxxxxxxx.loadbalancer.server.port=3000
traefik.http.services.https-1-xxxxxxxxxxxxxxxxxxxx.loadbalancer.server.port=3000
caddy_0.encode=zstd gzip
caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}
caddy_0.handle_path=/*
caddy_0.header=-Server
caddy_0.try_files={path} /index.html /index.php
caddy_0=*.example.com
caddy_1.encode=zstd gzip
caddy_1.handle_path.1_reverse_proxy={{upstreams 3000}}
caddy_1.handle_path=/*
caddy_1.header=-Server
caddy_1.try_files={path} /index.html /index.php
caddy_1=example.com
caddy_ingress_network=coolify

where xxxxxxxxxxxxxxxxxxxx is the service name of your app

[juliushoff]

Thanks for the quick answer !
So you have a A record for *.example.com to your vps IP setup in cloudflare and nothing else ?

[Seym0n]

Two A records pointing to the same IP

• A record: * points to IP (the subdomains
• A record: @ points to IP (the root)

In addition, on the Cloudflare side, you need to enable the SSL/TLS mode to 'Full' so that the connection along the entire route is encrypted. By default, the flexible mode is enabled in Cloudflare, which introduces some errors or infinite loop. No other changes in the Coolify Panel for SSL is required, they manage it automatically though

[juliushoff]

Hm, I have tried setting the SSL/TLS mode to 'Full' and also 'Full (strict)', but sadly for me there is still no ssl certificate for my subdomains.

This is the current config I am trying in coolify (I exclude demo and staging and subdomains because I use them on the staging application):

traefik.enable=true
traefik.http.middlewares.gzip.compress=true
traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https

# HTTP router for subdomains (excluding demo and staging)
traefik.http.routers.8ccg55ja83891923_http.entryPoints=http
traefik.http.routers.8ccg55ja83891923_http.middlewares=redirect-to-https
traefik.http.routers.8ccg55ja83891923_http.rule=HostRegexp(`.*\.example\.de`) && !Host(`demo.example.de`) && !Host(`staging.example.de`)
traefik.http.routers.8ccg55ja83891923_http.service=example_subdomain_service


# HTTPS router for subdomains (excluding demo and staging)
traefik.http.routers.8ccg55ja83891923_https.entryPoints=https
traefik.http.routers.8ccg55ja83891923_https.middlewares=gzip
traefik.http.routers.8ccg55ja83891923_https.rule=HostRegexp(`.*\.example\.de`) && !Host(`demo.example.de`) && !Host(`staging.example.de`)
traefik.http.routers.8ccg55ja83891923_https.service=example_subdomain_service
traefik.http.routers.8ccg55ja83891923_https.tls.certresolver=letsencrypt
traefik.http.routers.8ccg55ja83891923_https.tls=true



# Services configuration
traefik.http.services.example_subdomain_service.loadbalancer.server.port=3000

# Caddy configuration for subdomains (excluding demo and staging)
caddy_0.encode=zstd gzip
caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}
caddy_0.handle_path=/*
caddy_0.header=-Server
caddy_0.try_files={path} /index.html /index.php
caddy_0=~^(?!demo\.|staging\.).*\.example\.de$

[Seym0n]

I updated my template above, according to your service name it is:

traefik.enable=true
traefik.http.middlewares.gzip.compress=true
traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
traefik.http.routers.http-0-8ccg55ja83891923.entryPoints=http
traefik.http.routers.http-0-8ccg55ja83891923.middlewares=redirect-to-https
traefik.http.routers.http-0-8ccg55ja83891923.rule=HostRegexp(`.*\.example\.com`)
traefik.http.routers.http-0-8ccg55ja83891923.service=http-0-8ccg55ja83891923
traefik.http.routers.http-1-8ccg55ja83891923.entryPoints=http
traefik.http.routers.http-1-8ccg55ja83891923.middlewares=redirect-to-https
traefik.http.routers.http-1-8ccg55ja83891923.rule=Host(`example.com`) && PathPrefix(`/`)
traefik.http.routers.http-1-8ccg55ja83891923.service=http-1-8ccg55ja83891923
traefik.http.routers.https-0-8ccg55ja83891923.entryPoints=https
traefik.http.routers.https-0-8ccg55ja83891923.middlewares=gzip
traefik.http.routers.https-0-8ccg55ja83891923.rule=HostRegexp(`.*\.example\.com`)
traefik.http.routers.https-0-8ccg55ja83891923.service=https-0-8ccg55ja83891923
traefik.http.routers.https-0-8ccg55ja83891923.tls.certresolver=letsencrypt
traefik.http.routers.https-0-8ccg55ja83891923.tls=true
traefik.http.routers.https-1-8ccg55ja83891923.entryPoints=https
traefik.http.routers.https-1-8ccg55ja83891923.middlewares=gzip
traefik.http.routers.https-1-8ccg55ja83891923.rule=Host(`example.com`) && PathPrefix(`/`)
traefik.http.routers.https-1-8ccg55ja83891923.service=https-1-8ccg55ja83891923
traefik.http.routers.https-1-8ccg55ja83891923.tls.certresolver=letsencrypt
traefik.http.routers.https-1-8ccg55ja83891923.tls=true
traefik.http.services.http-0-8ccg55ja83891923.loadbalancer.server.port=3000
traefik.http.services.http-1-8ccg55ja83891923.loadbalancer.server.port=3000
traefik.http.services.https-0-8ccg55ja83891923.loadbalancer.server.port=3000
traefik.http.services.https-1-8ccg55ja83891923.loadbalancer.server.port=3000
caddy_0.encode=zstd gzip
caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}
caddy_0.handle_path=/*
caddy_0.header=-Server
caddy_0.try_files={path} /index.html /index.php
caddy_0=*.example.com
caddy_1.encode=zstd gzip
caddy_1.handle_path.1_reverse_proxy={{upstreams 3000}}
caddy_1.handle_path=/*
caddy_1.header=-Server
caddy_1.try_files={path} /index.html /index.php
caddy_1=example.com
caddy_ingress_network=coolify

and by excluding demo.* and staging.*

traefik.enable=true
traefik.http.middlewares.gzip.compress=true
traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
traefik.http.routers.http-0-8ccg55ja83891923.entryPoints=http
traefik.http.routers.http-0-8ccg55ja83891923.middlewares=redirect-to-https
traefik.http.routers.http-0-8ccg55ja83891923.rule=HostRegexp(`.*\.example\.com`) && !Host(`demo.example.com`) && !Host(`staging.example.com`)
traefik.http.routers.http-0-8ccg55ja83891923.service=http-0-8ccg55ja83891923
traefik.http.routers.http-1-8ccg55ja83891923.entryPoints=http
traefik.http.routers.http-1-8ccg55ja83891923.middlewares=redirect-to-https
traefik.http.routers.http-1-8ccg55ja83891923.rule=Host(`example.com`) && PathPrefix(`/`)
traefik.http.routers.http-1-8ccg55ja83891923.service=http-1-8ccg55ja83891923
traefik.http.routers.https-0-8ccg55ja83891923.entryPoints=https
traefik.http.routers.https-0-8ccg55ja83891923.middlewares=gzip
traefik.http.routers.https-0-8ccg55ja83891923.rule=HostRegexp(`.*\.example\.com`) && !Host(`demo.example.com`) && !Host(`staging.example.com`)
traefik.http.routers.https-0-8ccg55ja83891923.service=https-0-8ccg55ja83891923
traefik.http.routers.https-0-8ccg55ja83891923.tls.certresolver=letsencrypt
traefik.http.routers.https-0-8ccg55ja83891923.tls=true
traefik.http.routers.https-1-8ccg55ja83891923.entryPoints=https
traefik.http.routers.https-1-8ccg55ja83891923.middlewares=gzip
traefik.http.routers.https-1-8ccg55ja83891923.rule=Host(`example.com`) && PathPrefix(`/`)
traefik.http.routers.https-1-8ccg55ja83891923.service=https-1-8ccg55ja83891923
traefik.http.routers.https-1-8ccg55ja83891923.tls.certresolver=letsencrypt
traefik.http.routers.https-1-8ccg55ja83891923.tls=true
traefik.http.services.http-0-8ccg55ja83891923.loadbalancer.server.port=3000
traefik.http.services.http-1-8ccg55ja83891923.loadbalancer.server.port=3000
traefik.http.services.https-0-8ccg55ja83891923.loadbalancer.server.port=3000
traefik.http.services.https-1-8ccg55ja83891923.loadbalancer.server.port=3000
caddy_0.encode=zstd gzip
caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}
caddy_0.handle_path=/*
caddy_0.header=-Server
caddy_0.try_files={path} /index.html /index.php
caddy_0=*.example.com
caddy_1.encode=zstd gzip
caddy_1.handle_path.1_reverse_proxy={{upstreams 3000}}
caddy_1.handle_path=/*
caddy_1.header=-Server
caddy_1.try_files={path} /index.html /index.php
caddy_1=example.com
caddy_ingress_network=coolify

[juliushoff]

Hey, thanks again for all the help !
I used this config but also had to turn on "always use HTTPS" in my cloud dashboard. Now it works :)

[vikyw89]

how did you have 4 unique service names ?
I only got 2 for a single service,

• 1 for http
• 1 for https

[Seym0n]

It's in the format

http-0-<service-name>
http-1-<service-name>
https-0-<service-name>
https-1-<service-name>

which result in

traefik.http.routers.http-0-<service-name>.entryPoints=http
traefik.http.routers.http-0-<service-name>.middlewares=redirect-to-https
traefik.http.routers.http-0-<service-name>.rule=HostRegexp(`.*\.example\.com`)
traefik.http.routers.http-0-<service-name>.service=http-0-<service-name>

# HTTP router for root domain
traefik.http.routers.http-1-<service-name>.entryPoints=http
traefik.http.routers.http-1-<service-name>.middlewares=redirect-to-https
traefik.http.routers.http-1-<service-name>.rule=Host(`example.com`) && PathPrefix(`/`)
traefik.http.routers.http-1-<service-name>.service=http-1-<service-name>

[ajh123]

I done this by creating a CNAME record to my servers IP then another CNAME record with the name of * pointing to the CNAME of my server.

Then just configure you Coolify services to use the domain you want.

[juliushoff]

What domains you have configured in coolify then for the application ?
For me, when I use a subdomain that is handled over the cname, I do not get a https certificate :(

[ajh123]

@juliushoff I use Cloudflare so the requests are proxied through Cloudflare which means I get automatic HTTPS.

For the applicaion domain I use <thing>.example.com