- Unlimited domains per service, Let's Encrypt HTTP-01 issued on the server
- HTTP → HTTPS redirect and websockets out of the box
- Free
subdomains with TLS, backed by one wildcard record per server - Redirects (Traefik redirectRegex) with a whole-domain shorthand
- Per-domain HTTPS switch for Cloudflare Flexible SSL zones
- Routes regenerated automatically on every container start and stop
One Traefik per server, configured for you
Each server runs dockxo-traefik with a file provider only. The agent regenerates the dynamic configuration from the running containers’ labels and their IPs on the dockxo-proxy network, and rewrites it on every Docker start and stop event. There is nothing to hand-edit and nothing that drifts: what is running is what is routed.
Certificates are issued on the server that serves the domain with Let’s Encrypt HTTP-01, renewed by Traefik, and never pass through the panel.
Free subdomains
Every server owns a wildcard record (*.<server>.dockxo.app), created for you when the agent connects. Any service can take any number of free names under it — api.fsn1.dockxo.app, staging.fsn1.dockxo.app — with TLS, in one click. Private servers opt out so their IP is never published.
Custom domains
Point an A record at the server and add the domain. If the project or the account holds a Cloudflare token the panel can create or update the record for you, proxied or not, and when a service moves to another server the records that pointed at the old one follow it. A proxied record in a Flexible-SSL zone switches the domain to HTTP-only automatically so it cannot redirect-loop.
Redirects
Add redirects per service or per load balancer with Traefik’s redirectRegex, or use the whole-domain shorthand to send example.com to www.example.com. Hosts pinned by a rule are routed automatically.
Websockets and long requests
Websockets are proxied as-is, so chat apps, terminals and live dashboards work without extra configuration.