Wildcard DNS and SSL on Fly#

Register the domain#

I’m using your-new-domain.dev in this example, which is not a domain I have registered. .dev is interesting here because it requires SSL (or TLS if you want to be pedantic about it).

Create an application with an IPv4 and IPv6 IP address#

First, create an application:

1
fly apps create --name your-wildcard-dns-app

Then create both an IPv4 and an IPv6 address for the application:

1
fly ips allocate-v4 -a your-wildcard-dns-app
2
TYPE ADDRESS      REGION CREATED AT
3
v4   37.16.10.138 global 7s ago
4

5
fly ips allocate-v6 -a your-wildcard-dns-app
6
TYPE ADDRESS             REGION CREATED AT
7
v6   2a09:8280:1::1:3e99 global 4s ago

The IPv4 address is so you can serve traffic.

The IPv6 address is needed as part of Fly’s scheme to protect against subdomain takeover - see How CDNs Generate Certificates: A Note About a Related Problem for details.

Configuring DNS#

Now setup the following DNS records:

1
your-new-domain.dev   A: 37.16.10.138
2
your-new-domain.dev   AAAA: 2a09:8280:1::1:3e99
3
*.your-new-domain.dev CNAME: your-wildcard-dns-app.fly.dev.

That CNAME record does the real magic here.

Issue the certificate#

You can ask Fly to issue the certificate (which uses LetsEncrypt under the hood) by running this:

1
fly certs create "*.your-new-domain.dev" \
2
  -a your-wildcard-dns-app

Verifying the certificate#

There’s one last step: you need ta add an additional DNS record to verify the certificate.

Instructions for doing this can be found at:

1
https://fly.io/apps/your-wildcard-dns-app/certificates

Click to view your unverified certificate and you should get a set of information that includes the extra DNS entry you need to add.

It will look something like this:

1
_acme-challenge.your-new-domain.dev CNAME your-new-domain.dev.6g0mj.flydns.net.

Add that DNS record, then click the “Check again” button on the certificate screen and your certificate should be verified shortly afterwards.

Deploy an app#

With the certificate in place, you can deploy a Fly app (using regular Fly or the new Fly Machines). Traffic to any subdomain of your domain, with or without https://, will be served by your new application.

Configuring ports for your app#

One last detail which caught me out: you need to configure your Fly app to accept traffic on both port 80 AND port 443 for this to work.

This is needed even if your app itself only serves on port 80 (or 8000 or whatever). The configuration here tells Fly’s routing proxy what to do.

Using fly.toml this means there should be two services.ports sections - here’s an example that includes those:

1
app = "your-wildcard-dns-app"
2

3
kill_signal = "SIGINT"
4
kill_timeout = 5
5

6
[[services]]
7
  internal_port = 8000
8
  protocol = "tcp"
9

10
  [services.concurrency]
11
    hard_limit = 25
12
    soft_limit = 20
13

14
  [[services.ports]]
15
    handlers = ["http"]
16
    port = "80"
17

18
  [[services.ports]]
19
    handlers = ["tls", "http"]
20
    port = "443"
21

22
  [[services.tcp_checks]]
23
    interval = 10000
24
    timeout = 2000
25
    grace_period = "10s"

If you are using Fly Machines you’ll need to include the following in the JSON that is used to launch the machine:

1
    "services": [
2
      {
3
        "ports": [
4
          {
5
            "port": 80,
6
            "handlers": [
7
              "http"
8
            ]
9
          },
10
          {
11
            "port": 443,
12
            "handlers": [
13
              "tls",
14
              "http"
15
            ]
16
          }
17
        ],
18
        "protocol": "tcp",
19
        "internal_port": 8001
20
      }