Thanks to visit codestin.com
Credit goes to github.com

Skip to content

docs(docs/admin): document wildcard hostname suffixes #27482

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nickvigilante merged 1 commit into from
Jul 24, 2026
Merged

docs(docs/admin): document wildcard hostname suffixes #27482

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 30 additions & 5 deletions docs/admin/networking/wildcard-access-url.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,19 +22,35 @@ The following tools require wildcard access URL:

## Configuration

`CODER_WILDCARD_ACCESS_URL` is necessary for [port forwarding](port-forwarding.md#dashboard) via the dashboard or running [coder_apps](../templates/index.md) on an absolute path. Set this to a wildcard subdomain that resolves to Coder (e.g. `*.coder.example.com`).
`CODER_WILDCARD_ACCESS_URL` is necessary for [port forwarding](port-forwarding.md#dashboard) via the dashboard or running [coder_apps](../templates/index.md) on an absolute path.
Set it to a wildcard hostname that resolves to Coder.
The value must contain exactly one `*` at the beginning of the hostname.
Coder replaces `*` with the generated application name, which stays within a single DNS label.

```sh
export CODER_WILDCARD_ACCESS_URL="*.coder.example.com"
coder server
Coder supports the wildcard as a full label or with a suffix in the first label:

| Pattern | Example generated application hostname | Required DNS and TLS wildcard |
|----------------------|--------------------------------------------------|-------------------------------|
| `*.apps.example.com` | `8080--main--myworkspace--john.apps.example.com` | `*.apps.example.com` |
| `*-apps.example.com` | `8080--main--myworkspace--john-apps.example.com` | `*.example.com` |

For example, use the suffix pattern to keep the Coder dashboard and application hostnames at the same DNS level:

```dotenv
CODER_ACCESS_URL=https://apps.example.com
CODER_WILDCARD_ACCESS_URL=*-apps.example.com
```

This configuration serves the dashboard from `https://apps.example.com` and a workspace application from a hostname such as `https://8080--main--myworkspace--john-apps.example.com`.

### TLS Certificate Setup

Wildcard access URLs require a TLS certificate that covers the wildcard domain. You have several options:

> [!TIP]
> You can use a single certificate for both the access URL and wildcard access URL. The certificate CN or SANs must match the wildcard domain, such as `*.coder.example.com`.
> You can use a single certificate for both the access URL and wildcard access URL.
> For `*.apps.example.com`, the certificate must include `apps.example.com` and `*.apps.example.com`.
> For `*-apps.example.com` with an access URL of `apps.example.com`, a certificate for `*.example.com` covers both hostnames.

#### Direct TLS Configuration

Expand Down Expand Up @@ -82,6 +98,15 @@ Or alternatively, using a CNAME record:
*.coder.example.com CNAME coder.example.com
```

For a suffix pattern such as `*-apps.example.com`, DNS and TLS wildcards must cover the entire first label:

```txt
*.example.com A <your-coder-server-ip>
```

DNS providers and certificate authorities don't interpret `*-apps.example.com` as a wildcard record or certificate name.
Configure `*.example.com` instead, and ensure routing that wildcard to Coder doesn't conflict with other services under `example.com`.

### Workspace Proxies

If you're using [workspace proxies](workspace-proxies.md) for geo-distributed teams, each proxy requires its own wildcard access URL configuration:
Expand Down
8 changes: 4 additions & 4 deletions docs/admin/setup/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,10 +41,10 @@
> [!TIP]
> Learn more about the [importance and benefits of wildcard access URLs](../networking/wildcard-access-url.md)

`CODER_WILDCARD_ACCESS_URL` is necessary for
[port forwarding](../networking/port-forwarding.md#dashboard) via the dashboard
or running [coder_apps](../templates/index.md) on an absolute path. Set this to
a wildcard subdomain that resolves to Coder (e.g. `*.coder.example.com`).
`CODER_WILDCARD_ACCESS_URL` is necessary for [port forwarding](../networking/port-forwarding.md#dashboard) via the dashboard or running [coder_apps](../templates/index.md) on an absolute path.
Set it to a wildcard hostname that resolves to Coder, such as `*.coder.example.com` or `*-coder.example.com`.
The suffix form creates application hostnames such as `8080--main--myworkspace--john-coder.example.com`.
It requires a DNS record and TLS certificate for `*.example.com`.

> [!NOTE]
> We do not recommend using a top-level-domain for Coder wildcard access
Expand Down Expand Up @@ -124,7 +124,7 @@
psql "postgres://coder@localhost:49627/coder?sslmode=disable&password=feU...yI1"
```

### Migrating from the built-in database to an external database

Check warning on line 127 in docs/admin/setup/index.md

View workflow job for this annotation

GitHub Actions / lint-docs

Coder.GerundHeading 

Heading starts with an -ing word ('Migrating'); prefer the imperative ('Install') or the noun ('Installation'). See capitalization-and-punctuation.md#no-gerund-leading-headings.

To migrate from the built-in database to an external database, follow these
steps:
Expand All @@ -139,7 +139,7 @@
1. Start your Coder deployment with
`CODER_PG_CONNECTION_URL=<external-connection-string>`.

## Configuring Coder behind a proxy

Check warning on line 142 in docs/admin/setup/index.md

View workflow job for this annotation

GitHub Actions / lint-docs

Coder.GerundHeading 

Heading starts with an -ing word ('Configuring'); prefer the imperative ('Install') or the noun ('Installation'). See capitalization-and-punctuation.md#no-gerund-leading-headings.

To configure Coder behind a corporate proxy, set the environment variables
`HTTP_PROXY` and `HTTPS_PROXY`. Be sure to restart the server. Lowercase values
Expand Down
Loading