Wildcard Subdomain Setup with Cloudflare + Dokploy

[ahhmarr]

Environment: Dokploy version v0.25.10; Domain managed via Cloudflare (SSL encryption mode: Full (strict))

Steps I followed:

1. Cloudflare DNS → Created an A record for * pointing to my Dokploy server IP; SSL mode set to Strict.
   

2. Service in Dokploy → Created a service with raw Docker Compose content:

   version: '3.8'
   
   services:
     hello-world:
       image: ghcr.io/kljensen/hello-world-http:latest
       init: true
       environment:
         - HOST=0.0.0.0
         - PORT=8000
       ports:
         - "8000:8000"

3. Wildcard Subdomain → Added *.mydomain.com in Dokploy; enabled HTTPS with provider set to None.
   
   

4. Redeployment → Redeployed the service.

5. Test → Navigated to https://sub1.mydomain.com.

6. Issue → Browser shows 404 Not Found.

Expected Behavior: Any subdomain (e.g., sub1.mydomain.com, sub2.mydomain.com) should route to the hello-world service.
Actual Behavior: Requests to wildcard subdomains return 404.

My Question

• Is there an additional configuration required on the Dokploy side (Traefik labels, certificate provider, etc.) to make wildcard subdomains route correctly?
• Do I need to configure the HTTPS provider differently, instead of “None” for wildcard domains?
• Or is this a limitation/bug in v0.25.10?

[djsisson]

if you are proxying your dns in cloudflare, traefik cannot generate certificates using http challenge using lets encrypt
you have to either

1. use dns challenge
2. install a wildcard origin certificate from cf
3. terminate ssl at cloudflare and only use http in dokploy (not-recommended)

Also when using a wildcard domain rule, you can only do so with a wildcard certificate in traefik, which means DNS challenge or own wildcard certificate.

[ahhmarr]

Thanks for the suggestion. I think using custom Cloudflare certificates makes more sense in this case, but I’m having trouble enforcing it.

What I did:

1. generated orifin certificates at cloudflare
2. added the certificates to dokploy

3. Now trying to use the certificate in domains by something like this

4. traefik throws error logs

2025-11-25T10:01:25Z ERR Error while adding route for host error="error while adding rule HostSNI(`*.mydomain.com`): invalid value for HostSNI matcher, \"*.mydomain.com\" is not a valid hostname"

also seems the resolver is also incorrect

ERR Router uses a nonexistent certificate resolver certificateResolver=file routerName=some-service-9og2xz-router-websecure-14@file

I tried with cloudflare as the resolver as well but still the issue persist

[ahhmarr]

Something clicked when I read [this discussion](#2057 (comment)), and I was able to solve the issue.

What I did

• Created an application instead of compose, since applications allow overriding Traefik config.
• Created a placeholder domain. (Incidentally, it doesn’t let me modify traefik config if there are no domains created, hence this hack.)
• Went to /dashboard/traefik and overrode the Traefik config with the following:

http:
  routers:
    domain-test-gig5tv-router-18:
      rule: HostRegexp(`^([a-z0-9-]+)\.domain\.com$`)
      service: domain-test-gig5tv-service-18
      entryPoints:
        - web
        - websecure
      tls:
        options: {}
  services:
    domain-test-gig5tv-service-18:
      loadBalancer:
        servers:
          - url: http://domain-test-gig5tv:8000
        passHostHeader: true

• Deleted all the domains.
• Now all subdomains redirect to my application.

Note

This config change will override all subdomains and redirect them to this application.
The only workaround I found is to modify the regular expression to exclude specific subdomains, for example:

HostRegexp(`^(?!test|admin|domain-api)([a-z0-9-]+)\.domain\.com$`)

[djsisson]

you do not need to exclude any, you just set a low priority on the rule with a regexp, that way any named subdomains have higher priority and get picked first