Skip to content

Network Configuration

An App Server is reachable over HTTPS at one or more FQDNs (e.g. myapp-dev-cyril-msa21.example.com). This page explains how that FQDN is built and how to make it compatible with a single-level wildcard certificate (Cloudflare Universal SSL, or one Let's Encrypt wildcard).

How an FQDN is built

FQDN  =  <hostname>  .  <domain>
  • <hostname> — the DNS label, produced by an FQDN Generator.
  • <domain> — the DNS zone, from the App Server's Traefik server (or a forced DNS domain).

An App Server exposes two kinds of URL:

URL Source FQDN Generator
Direct URL the App Server's own reverse-proxy entry Direct URL FQDN Generator
Public URLs optional Traefik Application Definitions (e.g. a custom domain) the definition's own generator

This page covers the Direct URL.

The wildcard problem

A single-level wildcard certificate covers exactly one label under the domain:

  • *.example.com covers myapp.example.com ✅
  • *.example.com does not cover myapp.host1.example.com ❌ (that needs *.host1.example.com)

So the hostname must be a single flat label — no extra dots.

Direct URL FQDN Generator

The Direct URL FQDN Generator field (on the App Server and on the App Definition) controls the Direct URL's hostname. The default generator produces a flat label:

<server-name>-<host>          ->   myapp-dev-cyril-msa21.example.com

The host segment keeps URLs unique when several App Servers share the same domain on different physical/VM hosts — folded in as a dash, so the whole thing stays one DNS label and a *.example.com wildcard covers it.

Legacy behaviour without a generator

If no Direct URL FQDN Generator is set, the App Server falls back to the legacy scheme, which appends the host as a dotted sub-label:

myapp-dev-cyril.msa21.example.com      <- NOT covered by *.example.com

Select the Direct URL FQDN Generator to switch to the flat form.

The "Use LXD as Sub-domain" flag

use_lxd_host_as_subdomain controls whether the host appears in the hostname at all:

Flag With Direct URL FQDN Generator Result
On (default) host folded as a dash name-host.domain — unique across hosts
Off host omitted name.domain — only safe if name is unique within the domain

Leave it on unless your server names are already globally unique within the domain.

Configuring it

  1. On the App Server (or the App Definition, so instances inherit it), set Direct URL FQDN Generator to the flat generator.
  2. Make sure the Traefik server's DNS domain has a matching wildcard certificate (e.g. *.example.com).
  3. Reconfigure the reverse proxy — the Direct URL is recomputed.

Standard App Definitions are already set

The standard App Definitions (Odoo 18/19, Muppy, Sunray, Ubuntu) default to the flat Direct URL FQDN Generator, so new App Servers are wildcard-ready out of the box. Existing App Servers keep their current URL (empty field = legacy dotted) until you set the generator and reconfigure.

Customizing the naming

FQDN Generators are inline — they contain editable code, no module change needed. To change the naming scheme, duplicate the default generator, edit its code, and select your copy on the App Server or App Definition.