VACVAC
Apps

Custom domains

Give an app its own hostname — VAC routes it and Caddy issues the certificate.

2 min readUpdated June 15, 2026Edition · v0.5.xBeta

Every routable app already has an automatic subdomain. Custom domains let you put your own hostname in front of a specific service, with HTTPS handled for you.

Automatic subdomains

When a base domain is configured, VAC derives a hostname for each HTTP service — no setup, not even a stored record:

  • Single HTTP service: {app}.{domain} — e.g. checkout.example.com.
  • Multiple HTTP services: {service}.{app}.{domain} — e.g. api.checkout.example.com.

These are computed on the fly, so changing the base domain regenerates them instantly. They're covered by the wildcard *.{domain} A record you set during installation.

Attaching a custom domain

From the app's Domains section (or the global Domains hub in Settings), add a hostname and choose which service it routes to. A domain is always bound to a single service within an app.

Then point DNS at the box:

shop.example.com   IN  A   203.0.113.42

A subdomain can use a CNAME to your base domain instead, if that's already pointed at the host.

No verification dance

There are no TXT-record ownership checks. On a single-operator box, placing the DNS record yourself is the proof of control — and Caddy only issues certificates for hostnames VAC knows about.

HTTPS certificates

Caddy issues a certificate per hostname, on demand, via the ACME HTTP challenge the first time the hostname is hit. The first request after DNS resolves may take a few seconds while the cert is obtained; after that it's cached and auto-renewed.

For this to work, ports 80 (for the ACME challenge) and 443 must be reachable on the host.

Per-host, not wildcard

By default each hostname gets its own certificate via the HTTP challenge — VAC does not issue a single wildcard cert. That keeps issuance automatic with no DNS-provider credentials.

Live status

Each domain shows a live status as VAC probes DNS and the certificate:

checkingawaiting_dnsmisconfiguredissuingactive (or error)

The dashboard surfaces the exact A record to create, the certificate expiry, and a Refresh button that re-probes against a public resolver (so DNS changes reflect quickly). VAC also warns you ahead of certificate expiry via notifications.

Redirects

A domain can 308-redirect to another instead of proxying — the classic www → apex (or apex → www) case. Add both hostnames, then set one's redirect target to the other. The full request path and query string are preserved. A redirecting domain must be assigned to an app.

The dashboard's own domain

The control-plane hostname (vac.{domain} by default, or whatever you set as the control domain) is handled the same way — Caddy issues its cert on demand and routes it to vac-api. You can change the base domain at runtime without reinstalling; see vac set-domain.

Next

On this page