functions custom domain issues in self hosted

I’m running self-hosted Appwrite (Docker) behind Traefik with Cloudflare proxy (Full/Strict).

Main domain works: https://app.printa4.in

Function subdomains fail TLS completely, e.g. https://<functionId>.functions.printa4.in

openssl result:

SSL alert number 40: handshake failure no peer certificate available

This means the origin doesn’t present any cert for function subdomains.

Setup:

Cloudflare terminates TLS

Traefik + Appwrite are HTTP-only

Env vars:

_APP_DOMAIN=app.printa4.in _APP_DOMAIN_FUNCTIONS=functions.printa4.in

Suspected cause: Function subdomains (*.functions.<domain>) don’t inherit routing automatically and require an explicit wildcard HostRegexp router in the reverse proxy.

Question: What is the official / recommended reverse-proxy configuration for Appwrite function subdomains when using Cloudflare + Traefik? Should TLS be handled at the proxy or by Appwrite itself for functions?

Any guidance or docs would be really helpful 🙏

TL;DR

Issue with setting up custom domains for functions in a self-hosted setup. Discusses problems with using Cloudflare proxy for second-layer subdomains and SSL generation by Traefik. Solution: For SSL error 526, check domain configuration using resources provided by Cloudflare support.

<:Auth:1389993762654130246>

Have you find a solution to this yet? I am having the exact same setup and issue right now

if your using free proxied, iirc it don't support 2nd layer sub domains

https://community.cloudflare.com/t/use-a-second-level-sub-domains-with-ssl/405833/4

i also ping you since you also have the issue

Yes, that is correct. But doesn't traefik generate SSL for the function subdomain? Or am I mistaken?

yes, but you need to disable the proxy, as cloudflare with proxy basicly request itself from the server, then sends it to you with it's own server and ssl cert (if you check the ssl certificate, it's not let's encrypt)

I see. Alright, thanks for the clarification

I think I'll just ditch the first subdomain

my setup with cloudflare is like this : *.appwrite.example.com > functions/sites > not proxied appwrite.example.com > console/api > proxied

so console shows cloudflare certificate and sites shows let's encrypt

also be carful, if you upload big files (iirc over 100mb) you cannot do it with proxied because of the free limitation (entreprise is 500mb)

Yeah, I prefer to have the proxy on and I know about the size limitation. I wish appwrite would use a different approach to handle file upload via S3 compatible API so that we can use pre-signed url to do the upload directly to R2. But that's a separate matter