Traefik Domain Routing#

Dokploy converts each Domain database record into Traefik routing configuration at deploy time. There are two distinct code paths depending on service type:

Both paths share the same Domain schema and produce equivalent routing rules.

Domain Schema#

The domains table is defined in packages/server/src/db/schema/domain.ts. Key fields that drive routing:

1

Compose Path: Label Injection#

Injection flow#

1. getBuildComposeCommand() calls writeDomainsToCompose() before executing the deploy command.
2. writeDomainsToCompose() calls addDomainToCompose(), which loads the compose file, optionally applies randomization/isolated-deployment transforms, then iterates each domain.
3. For each domain, createDomainLabels() builds the Traefik label list, which is prepended to services.<name>.labels (docker-compose) or services.<name>.deploy.labels (Swarm stack) 2.
4. The modified compose spec is serialized to YAML, base64-encoded, and written back to disk via a shell command 3.

Router naming#

Router and service names follow the pattern {appName}-{uniqueConfigKey}-{entrypoint} 4. This ensures uniqueness across multiple domains on the same app.

Labels generated by createDomainLabels()#

For each domain + entrypoint combination 5:

traefik.http.routers.<name>.rule=Host(`<host>`) [&& PathPrefix(`<path>`)]
traefik.http.routers.<name>.entrypoints=<entrypoint>
traefik.http.services.<name>.loadbalancer.server.port=<port>
traefik.http.routers.<name>.service=<name>

Conditional labels appended:

• Network: traefik.docker.network=dokploy-network (docker-compose) or traefik.swarm.network=dokploy-network (stack), omitted for isolated deployments 6.
• TLS cert: tls.certresolver=letsencrypt, tls.certresolver=<custom>, or tls=true for none+https 7.
• Middlewares: redirect-to-https@file (web redirect router), stripprefix-*, addprefix-*, and any custom middlewares from domain.middlewares 8.

HTTPS dual-router logic#

When https=true and no customEntrypoint is set, addDomainToCompose() generates two routers 9:

• web router — carries only redirect-to-https@file; all other middlewares are skipped here.
• websecure router — carries TLS config and all real middlewares (strip/add prefix, custom).

If customEntrypoint is set, only one router is created for that single entrypoint.

Application Path: File Config#

Regular (non-compose) applications use manageDomain() in packages/server/src/utils/traefik/domain.ts. Instead of labels, it writes per-app Traefik YAML config files to disk via writeTraefikConfig / writeTraefikConfigRemote.

Router names follow a slightly different pattern: {appName}-router-{uniqueConfigKey} (without the entrypoint suffix) 10. The HTTPS split still applies: a *-websecure-{uniqueConfigKey} router is added when https=true 11.

createRouterConfig() additionally handles:

• Punycode conversion for internationalized domain names 12.
• Redirect rules from the parent app — skipped for domainType === "preview" so wildcard preview subdomains don't inherit the parent's redirect middlewares 13.
• Security middlewares (basic auth) — the middleware name is derived from the parent app for preview domains 14.
• Forward-auth (SSO) — when forwardAuthEnabled=true, error and auth middlewares are prepended 15.

Network Wiring#

For Traefik to reach compose services, services must share a network with the Traefik container.

• Shared mode (default): dokploy-network (external) is injected into the service's network list and into the compose root networks block by addDokployNetworkToService() and addDokployNetworkToRoot(). The traefik.docker.network=dokploy-network label tells Traefik which network to use for routing.
• Isolated mode (isolatedDeployment=true): a per-app named network is created at deploy time and the Traefik container is connected to it 16. The traefik.docker.network label is omitted; Traefik finds the service on the isolated network automatically.

See the Docker Compose Networking article for more detail on network injection and collision prevention.

Key Source Files#