Building DynaSite in public: custom domains support

• user adds a custom domain to their blog
• the app creates an ingress resource in Kuberrnetes for that domain with support for unencrypted traffic on port 80
• the app exposes a special, unique and difficult to guess path at http://domain.com/verification/<some long UUID>
• the app polls every few seconds that path and checks the response. If the response contains a matching key, then it flags the domain as verified because it means that the domain is correctly pointing to our app. The domain remains in pending verification state in the UI until this condition is met
• once the domain is verified, the ingress resource is "upgraded" with support for encrypted connections, meaning that it adds to the ingress resource the required annotation to trigger a certificate issuance request to Let's Encrypt  via cert-manager
• once the certificate is issued successfully, the domain is marked as ready and the app can start serving the user's content from their custom domain
• when a custom domain is removed by the user, the relevant ingress resource is also deleted

Cloudflare for SaaS

If you don't have a Cloudflare account yet, you'll need to create one (there's a free plan) and migrate your domain's DNS configuration to Cloudflare.

Once the domain is ready, you need to configure a DNS record pointing to your SaaS. Cloudflare will forward any traffic for custom hostnames to the hostname you configure in this record. Make sure the proxy is enabled for this record (orange cloud).


 

Next, head to

and enable the feature, then add a "fallback origin":

Once it's active, you can start adding custom domains for your users. For simplicity, I use the HTTP verification method:

Give it a few moments, and then the hostname will appear as ready:

Dokku

rm /etc/nginx/sites-enabled/default
dokku nginx:stop
dokku nginx:start

server {
  listen 80 default_server;
  listen [::]:80 default_server;
  listen 443 ssl default_server;
  listen [::]:443 ssl  default_server;
  server_name _;

  access_log  /var/log/nginx/dynasite-access.log;
  error_log   /var/log/nginx/dynasite-error.log;

  ssl_certificate           /home/dokku/dynasite/tls/server.crt;
  ssl_certificate_key       /home/dokku/dynasite/tls/server.key;
  ssl_protocols             TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers off;
  keepalive_timeout   70;

  location    / {
    gzip on;
    gzip_min_length  1100;
    gzip_buffers  4 32k;
    gzip_types    text/css text/javascript text/xml text/plain text/x-component application/javascript application/x-javascript application/json application/xml  application/rss+xml font/truetype application/x-font-ttf font/opentype application/vnd.ms-fontobject image/svg+xml;
    gzip_vary on;
    gzip_comp_level  6;

    proxy_pass  http://dynasite-3000;

    proxy_http_version 1.1;
    proxy_read_timeout 60s;
    proxy_buffer_size 4096;
    proxy_buffering on;
    proxy_buffers 8 4096;
    proxy_busy_buffers_size 8192;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Forwarded-Port $server_port;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Request-Start $msec;
  }
}

sudo nginx -t
sudo nginx -s reload

Wrapping up