[GH-ISSUE #499] Add support for cloudflare origin certificates & custom-hostnames #316

New issue

Open

opened 2026-03-03 11:29:12 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 11:29:12 +03:00

Owner

Originally created by @pavanbhaskardev on GitHub (Dec 3, 2025).
Original GitHub issue: https://github.com/dflow-sh/dflow/issues/499

Originally assigned to: @pavanbhaskardev on GitHub.

Decription

Moves traefik configuration from fileProvider to etcd, uses cloudflare origin-certificate & custom-hostnames instead of letsencrypt resolver

Why

Everytime when service is deployed a new certificate is generated using the wildcard domain, Cloudflare origin-certificate resolves that single certificate for entire wild-card domain. We now can use Cloudflare DDOS, WAF and BOT protection.

Server Changes

Domains configuration tab in server page
Because custom-domain add server-level will propagate to each service
So custom-hostname validation needs to be done

Service Changes

Update domain format from serviceName.serverHostname.up.domain.com -> serviceName-serverHostname.up.domain.com
Migrate traefik from letsencrypt configuration to cloudflare origin certificate
Migrate custom-domain configuration to cloudflare custom-hostnames with TXT validation
Remove Certificate Type, Regenerate SSL option

Onboarding Changes

Remove following steps
- letsencrypt plugin installation
- global email configuration
Move custom domain attachment to 1st step

Docs

Update traefik configuration in docker-compose.yaml
- Use etcd instead for fileProvider
- Use cloudflare origin certificate instead on letsencrypt resolver
Create a migration script to change file-based configuration to etcd configuration

Originally created by @pavanbhaskardev on GitHub (Dec 3, 2025). Original GitHub issue: https://github.com/dflow-sh/dflow/issues/499 Originally assigned to: @pavanbhaskardev on GitHub. ## Decription Moves traefik configuration from fileProvider to etcd, uses cloudflare origin-certificate & custom-hostnames instead of letsencrypt resolver ## Why Everytime when service is deployed a new certificate is generated using the wildcard domain, Cloudflare origin-certificate resolves that single certificate for entire wild-card domain. We now can use Cloudflare DDOS, WAF and BOT protection. ## Server Changes - Domains configuration tab in server page - Because custom-domain add server-level will propagate to each service - So custom-hostname validation needs to be done ## Service Changes - Update domain format from `serviceName.serverHostname.up.domain.com` -> `serviceName-serverHostname.up.domain.com` - Migrate traefik from letsencrypt configuration to cloudflare origin certificate - Migrate custom-domain configuration to cloudflare custom-hostnames with TXT validation - Remove Certificate Type, Regenerate SSL option ## Onboarding Changes - Remove following steps - letsencrypt plugin installation - global email configuration - Move custom domain attachment to 1st step ## Docs - Update traefik configuration in docker-compose.yaml - Use `etcd` instead for `fileProvider` - Use cloudflare origin certificate instead on letsencrypt resolver - Create a migration script to change file-based configuration to etcd configuration