troubling proxy host(s) setting

[wdiechmann]

I add this discussion knowning that I most probably is ill-informed but neither 'chet' nor 'claude', 'mr google' or other sources have come through for me - so here goes.

Running 2 apps on Hetzner with zero issues (ibm and apple - obviously not but anyways) and now my ambitions made me turn the volume to 11 (fizzy.do is magnificient marketing) with app 3 but now all of a sudden all i can do is host: meta.com,aws.com ?

Does anyone see through this?
(and so sorry to leave this pile of dirt below - but to iron out the 'usual suspects' I tried to share what I believe to be the utmost necesssary to deal with this. Is this a) a 'bug' b) not supported or c) me being a total n00b?)

DETAILS

Environment

Ruby: 3.4.4
gem "rails", github: "rails/rails", branch: "main"  # revision: d7ab0e7cd433c23b4855c72c96e07b5b547d61db
gem "propshaft"                                     # 1.3.1 - probably irrelevant but hey now you know 😉 
gem "puma", ">= 5.0"                                # 7.1.0
gem "kamal", require: false                         # 2.8.2
gem "thruster", require: false                      # 0.1.16

meta.com and aws.com both are behind CloudFlare (in so far they are serving 😆 ) proxied with flexible SSL

What I've tested

If I do

proxy: 
  ssl: false
  host: 
    - meta.com
    - aws.com

i get

  ERROR (Kamal::ConfigurationError): proxy/host: should be a string

---

if I do

  hosts:
    - meta.com
    - aws.com

I get

√ holos % bin/kamal details -d staging
  ERROR (Kamal::ConfigurationError): proxy: Specify one of 'host' or 'hosts', not both

(and no - there is no other 'host' or 'hosts' mentioned in the deploy.staging.yml)

---

If I do

proxy:
  ssl: false
  app_port: 3000

I get

Service            Host             Path  Target             State    TLS  
ibm-web            ibm.com          /     c5662e23f930:3000  running  yes  
holos-web-staging  app.example.com  /     639f74a1ce2b:3000  running  no   
apple-web          apple.com.       /     c778c52f03ed:80    running  yes  

(and no - there is no other mentions of app.example.com in the project what so ever)

---

and if I go with my favorite choice of arms (what I'd actually really like to do )

proxy: 
  ssl: false
  host: "*"
  app_port: 3000

i get this

root@winebar-ubuntu-4gb-hel1-12:~# docker exec kamal-proxy kamal-proxy list
Service            Host             Path  Target             State    TLS  
ibm-web            ibm.com          /     c5662e23f930:3000  running  yes  
holos-web-staging  *                /     639f74a1ce2b:3000  running  no   
apple-web          apple.com.       /     c778c52f03ed:80    running  yes  

hopes were high and ibm and apple are super-green (The Sixth Element is forever one of my favorites) but meta and aws provide me with this in the kamal proxy logs

2025-12-05T13:16:22.291786012Z {"time":"2025-12-05T13:16:22.291494613Z","level":"INFO","msg":"Request","host":"meta.com","port":80,"path":"/","request_id":"9246c15f-ce07-4ae4-b35f-d80a7c3c3fca","status":404,"service":"","target":"","duration":114360,"method":"GET","req_content_length":0,"req_content_type":"","resp_content_length":4492,"resp_content_type":"text/html; charset=utf-8","client_addr":"162.158.134.231","client_port":"13821","remote_addr":"1.2.3.4","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","proto":"HTTP/1.1","scheme":"http","query":""}

2025-12-05T13:16:26.518479701Z {"time":"2025-12-05T13:16:26.518307102Z","level":"INFO","msg":"Request","host":"aws.com","port":80,"path":"/signin","request_id":"6d90c067-4fd1-492f-bb7f-e0c304182206","status":404,"service":"","target":"","duration":104200,"method":"GET","req_content_length":0,"req_content_type":"","resp_content_length":4492,"resp_content_type":"text/html; charset=utf-8","client_addr":"172.68.243.144","client_port":"12770","remote_addr":"1.2.3.4","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","proto":"HTTP/1.1","scheme":"http","query":""}

here are the sordid details of my proxy settings in the 3 apps (deploy.staging.yml)

app 1:

proxy:
  ssl: true
  host: ibm.com

app 2:

proxy:
  # kamal-proxy replaces Traefik in Kamal 2.x
  ssl: true                 
  host: apple.com
  app_port: 3000
  forward_headers: true
  healthcheck:
    path: "/"               # Kamal will hit this before switching traffic
    interval: 2             # seconds between checks (optional, sane default)
    timeout: 2              # seconds before giving up (optional)

app 3:

proxy:
  ssl: false
  hosts:
    - meta.com
    - aws.com
  app_port: 3000