konnosDashboard
wildcard-apps.yml55 lines · main
1# Wildcard routing for *.apps.briven.tech — every project subdomain
2# resolves to the control-plane API, which extracts the subdomain
3# (project slug or id) and dispatches to the runtime. This is the
4# public "call your function" URL shape: p_xxx.apps.briven.tech/<fn>.
5#
6# Deploy path (the controller drops this file via scp; Dokploy's
7# Traefik file-provider watches /etc/dokploy/traefik/dynamic/*.yml):
8#
9# scp infra/traefik/wildcard-apps.yml \
10# root@187.124.64.116:/etc/dokploy/traefik/dynamic/wildcard-apps.yml
11#
12# Traefik picks it up within seconds — no restart needed.
13#
14# TLS: wildcard cert via Let's Encrypt DNS-01 against Cloudflare.
15# The `cloudflare` cert resolver is defined in the Traefik static
16# config and reads CF_DNS_API_TOKEN from the container env (loaded
17# via --env-file /root/.briven-secrets/cloudflare.env). The token
18# is scoped to Zone:DNS:Edit + Zone:Read on briven.tech only.
19#
20# HostRegexp routers can't infer the cert domain on their own, so
21# the websecure router declares it explicitly in tls.domains.
22
23http:
24 routers:
25 wildcard-apps-web:
26 # Plain HTTP -> redirect to HTTPS.
27 rule: "HostRegexp(`^[a-z0-9-]+\\.apps\\.briven\\.cloud$`)"
28 entryPoints:
29 - web
30 service: wildcard-apps-api
31 middlewares:
32 - redirect-to-https
33
34 wildcard-apps-websecure:
35 rule: "HostRegexp(`^[a-z0-9-]+\\.apps\\.briven\\.cloud$`)"
36 entryPoints:
37 - websecure
38 service: wildcard-apps-api
39 middlewares: []
40 tls:
41 certResolver: cloudflare
42 domains:
43 - main: "*.apps.briven.tech"
44 sans:
45 - "apps.briven.tech"
46
47 services:
48 wildcard-apps-api:
49 loadBalancer:
50 # Route to the same swarm service the regular API uses.
51 # passHostHeader=true so the Hono middleware can read the
52 # original subdomain and derive the project id.
53 servers:
54 - url: "http://app-hack-mobile-sensor-xw9qop:3001"
55 passHostHeader: true