Custom domains
Give an app its own hostname — VAC routes it and Caddy issues the certificate.
Every routable app already has an automatic subdomain. Custom domains let you put your own hostname in front of a specific service, with HTTPS handled for you.
Automatic subdomains
When a base domain is configured, VAC derives a hostname for each HTTP service — no setup, not even a stored record:
- Single HTTP service:
{app}.{domain}— e.g.checkout.example.com. - Multiple HTTP services:
{service}.{app}.{domain}— e.g.api.checkout.example.com.
These are computed on the fly, so changing the base domain regenerates them instantly. They're
covered by the wildcard *.{domain} A record you set during installation.
Attaching a custom domain
From the app's Domains section (or the global Domains hub in Settings), add a hostname and choose which service it routes to. A domain is always bound to a single service within an app.
Then point DNS at the box:
shop.example.com IN A 203.0.113.42A subdomain can use a CNAME to your base domain instead, if that's already pointed at the host.
There are no TXT-record ownership checks. On a single-operator box, placing the DNS record yourself is the proof of control — and Caddy only issues certificates for hostnames VAC knows about.
HTTPS certificates
Caddy issues a certificate per hostname, on demand, via the ACME HTTP challenge the first time the hostname is hit. The first request after DNS resolves may take a few seconds while the cert is obtained; after that it's cached and auto-renewed.
For this to work, ports 80 (for the ACME challenge) and 443 must be reachable on the host.
By default each hostname gets its own certificate via the HTTP challenge — VAC does not issue a single wildcard cert. That keeps issuance automatic with no DNS-provider credentials.
Live status
Each domain shows a live status as VAC probes DNS and the certificate:
checking → awaiting_dns → misconfigured → issuing → active (or error)
The dashboard surfaces the exact A record to create, the certificate expiry, and a Refresh button that re-probes against a public resolver (so DNS changes reflect quickly). VAC also warns you ahead of certificate expiry via notifications.
Redirects
A domain can 308-redirect to another instead of proxying — the classic www → apex (or
apex → www) case. Add both hostnames, then set one's redirect target to the other. The full
request path and query string are preserved. A redirecting domain must be assigned to an app.
The dashboard's own domain
The control-plane hostname (vac.{domain} by default, or whatever you set as the control domain)
is handled the same way — Caddy issues its cert on demand and routes it to vac-api. You can
change the base domain at runtime without reinstalling; see vac set-domain.