Allow wildcard or catch-all host forwarding in Kamal proxy

[jcmaciel]

Hello!

I’m using Kamal to deploy a Rails application that offers custom domain support to my clients. Right now, I have this snippet in my deploy.yml:

proxy:
  ssl: true
  forward_headers: true
  hosts:
    - interactivefunnel.com
    - custom.interactivefunnel.com

Any requests from these hosts are properly forwarded to my Rails container. However, if a client sets up a custom domain (for example, quiz.clientdomain.com) that CNAMEs to custom.interactivefunnel.com, Kamal rejects the request with a 404 response before it even reaches the Rails app. That’s because quiz.clientdomain.com is not listed under proxy.hosts.

Current Problem

• I want each customer to add their own custom domain (e.g., quiz.clientdomain.com) pointing via CNAME to custom.interactivefunnel.com, or directly to my server’s IP behind Kamal.
• Each time a new client domain is added, the request is blocked with a 404 unless I manually add that domain to the hosts array in deploy.yml and then redeploy.
• This is difficult to scale if many clients add custom domains every day. Rebuilding or redeploying on each addition is not practical.

What I’ve Tried

1. Multiple proxies with a wildcard (hosts: ['*']) — doesn’t seem to work, or it conflicts with existing hosts.
2. Hooks or scripts to dynamically rebuild deploy.yml — it might work, but would still require a redeploy (and can be cumbersome).
3. Flexible SSL or other Cloudflare setups — the problem is not just SSL; it’s that Kamal’s proxy won’t route unknown hosts unless they’re explicitly declared.

My Question / Feature Request

Is there a way to configure Kamal proxy as a “catch-all” or wildcard so that any incoming host is forwarded to my Rails container? The Rails application itself already handles these requests by checking request.host against a database. But currently, the Kamal proxy blocks them before they reach Rails.

I’d greatly appreciate any guidance or best practices on handling custom domains without having to add each new domain to the hosts list and redeploy every time.

Thank you!

[jcmaciel]

@kevinmcconnell can you help me?

[kevinmcconnell]

Hi @jcmaciel, at the moment Kamal Proxy will only allow you to do this if it's not providing the SSL.

To use the ssl: true option, Kamal Proxy needs to know the set of hostnames that it's allowed to serve on, and then it will provision certificates for those hosts as necessary. So if you set ssl: true, you also need to set hosts. This restriction is mainly so that people can't abuse the service to request certificates for arbitrary hosts and exhaust your rate limits.

If you have the option to handle your SSL in another layer, then you can omit both the ssl and hosts sections of your config. In that situation, Kamal Proxy won't have any host restrictions, and will forward all the traffic to your app. (The downside, of course, is you'll have to solve the SSL part some other way.)

We actually have a PR in the works for this exact use case (#63). It's not merged yet, but when that lands it will allow your app to signal to the proxy which hosts should be allowed. That will give you dynamic host support along with the automatic SSL. That will probably be the best option, once it's available.

Hope that helps!

[jcmaciel]

Hey Kevin @kevinmcconnell , thanks for your support.

I've made a few changes to move forward with the project, even though I know they're not recommended.

See below:

• set my deploy.yml to catch-all, removing all mentions of proxy and ssl
  (my main domain, interactivefunnel.com is managed by cloudflare, using FULL mode

• create a hook (post deploy) on kamal.

• finnaly i have two kamal-proxys:
  

All works fine, but is no too elegant solution haha

Thanks!