Ingress, SSL & Tunnels

Traefik routes incoming HTTP and HTTPS by hostname. Apps use the shared network unless an operator explicitly publishes a port. Operators can add custom- prefixed proxy configuration, validated before applying with rollback on rejection, and upload PEM certificates whose private keys are encrypted at rest.

SSL & Wildcard Domains

• Automatic Let's Encrypt HTTP-01 challenge for custom domains.
• Cloudflare DNS-01 integration for wildcard certificates (*.yourdomain.com).
• Automatic subdomains: configure NINEDEPLOY_WILDCARD_DOMAIN to auto-assign {service-name}.yourdomain.com.
• Dynamic middleware: basic auth, rate limiting, IP whitelisting, and custom response headers.

Cloudflare Tunnels

Expose self-hosted services without opening router ports or exposing public IPs. Connect a Cloudflare Tunnel token in Settings, and NineDeploy proxies traffic through Cloudflare's edge securely.