feat(settings): add wildcard domain restriction#108
Merged
Conversation
Ports Dokploy#4259 by @TuroYT. Adds an optional server-level domain restriction: admins define allowed wildcard patterns (*.example.com or **.example.com) in web-server settings, and new application/compose domains are validated against them. Adds the domainRestrictionConfig jsonb column (drizzle migration 0179), a subdomain + base-domain picker in the domain form when restriction is enabled, and the settings UI. Completes the upstream PR, which referenced apiUpdateDomainRestriction from the settings router without defining it; added it as a thin wrapper around domainRestrictionConfigSchema. Also removed dead/unreachable duplicate else-if branches in matchesWildcardPattern. The fork's sslip.io generated domains are preserved (upstream is based on traefik.me). Co-authored-by: Romain PINSOLLE <romain.pins@gmail.com>
# Conflicts: # apps/dokploy/components/dashboard/application/domains/handle-domain.tsx # apps/dokploy/drizzle/meta/_journal.json # packages/server/src/index.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an optional server-level domain restriction. When enabled, admins define allowed wildcard patterns and new application/compose domains must match one of them.
packages/server/src/db/schema/web-server-settings.ts): newdomainRestrictionConfigjsonb column ({ enabled, allowedWildcards }, default disabled) +domainRestrictionConfigSchemavalidation (patterns must start with*.or**.).packages/server/src/utils/wildcard-restriction.ts, new):matchesWildcardPatternsupports single-level (*.example.com) and multi-level (**.example.com) wildcards plus exact match;validateDomainRestrictionreads the config and validates a host.services/domain.ts) on domain create/update.settings.ts):updateDomainRestrictionadmin mutation + config getter.domain-restriction.tsx), and a subdomain + base-domain picker in the domain form when restriction is enabled (handle-domain.tsx).Ports Dokploy#4259 by @TuroYT
Adaptations
settings.tsimports and usesapiUpdateDomainRestriction, but the PR never defines it. Addedexport const apiUpdateDomainRestriction = z.object({ domainRestrictionConfig: domainRestrictionConfigSchema })(matches the{ domainRestrictionConfig }shape the UI sends).matchesWildcardPatternhad an empty exact-match branch followed by unreachable duplicate**./ exact-match else-ifs (biomenoDuplicateElseIf); collapsed to a single correct exact-match branch.sslip.iogenerated-domain branding (upstream is based ontraefik.me); kept the fork's<TabsList variant="line">and schema columns (remoteServersOnly,buildsConcurrency,enforceSSO) alongside the new one.Merge-order note
Carries drizzle migration 0179. Merge after fork #11/#12 (which hold 0175/0176) and after the sibling PR holding slot 0178 (Dokploy#4141, ECR). Sibling migration PRs conflict only trivially in
apps/dokploy/drizzle/meta/_journal.json— keep both entries, idx-ordered.Verification
pnpm --filter=dokploy run typecheckpasses.vitest run __test__/traefik/server/update-server-config.test.ts: 5 passed.biome checkclean on all changed files.