Dokploy Dashboard/Admin Panel available only under dokploy-Subdomain

[carlooon]

Hey everyone!

Im asking if someone could help with setting up dokploy in such a way, that the dashboard is only accessible on dokploy.whateverdomain.tld. I dont want whateverdomain.tld to be the dashboard, even throwing a 404 or some error-code for now. I tried on my own but Im getting an "Invalid Origin" when im trying to login in over the dokploy.whateverdomain.tld.

Thanks if someone could help or provide a manual. I already searched the docs but maybe I missed something.

My dokploy.yml inside of traefik.

http:
  routers:
    dokploy-router-app:
      rule: Host(`dokploy.whateverdomain.tld`)
      service: dokploy-service-app
      entryPoints:
        - web
      middlewares:
        - redirect-to-https
    dokploy-router-app-secure:
      rule: Host(`dokploy.whateverdomain.tld`)
      service: dokploy-service-app
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt

    root-dead-end:
      rule: Host(`whateverdomain.tld`)
      entryPoints:
        - web
        - websecure
      service: noop-service
      middlewares:
        - return-404
      tls:
        certResolver: letsencrypt

  middlewares:
    redirect-to-https:
      redirectScheme:
        scheme: https
    return-404:
      redirectRegex:
        regex: ".*"
        replacement: ""
        permanent: false

  services:
    dokploy-service-app:
      loadBalancer:
        servers:
          - url: http://dokploy:3000
        passHostHeader: true
    noop-service
      loadBalancer:
        servers:
          - url: http://127.0.0.1:1

[dosubot[bot]]

Hi @carlooon! I'm Dosu and I’m helping the dokploy team.

The "Invalid Origin" error happens because Dokploy uses better-auth for authentication, which validates that incoming requests come from a trusted origin. Your subdomain dokploy.whateverdomain.tld isn't in that list yet.

The fix is through the Web Server Settings in the Dokploy dashboard:

1. Access Dokploy via the original IP and port: http://<your-server-ip>:3000 [1]
2. Go to Settings → Web Server (or the Web Server section in the dashboard)
3. Set your domain to dokploy.whateverdomain.tld and enable HTTPS / Let's Encrypt as needed [2]
4. Save — this updates the database and automatically adds the domain to Dokploy's trusted origins list [3]

Dokploy manages trusted origins in the database, not via environment variables, so your Traefik config alone isn't enough — the dashboard itself needs to know about the subdomain [4].

Once that's configured, your Traefik dokploy.yml routing should work. One small note on your config: the noop-service block appears to be missing a colon (noop-service:) which would cause a YAML parse error.

If you also want to manage trusted origins more granularly (e.g., keep IP-based access too), you can add additional origins through the dashboard or the API endpoints (addTrustedOrigin, removeTrustedOrigin) [5].

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}