Introduction

What the addon does

PawProxy adds a Proxy tab to every server in the panel. From there, the user can assign a custom domain (for example play.mysite.com) pointing to their server, with automatic reverse proxy handled by nginx on the node, and choose how SSL is handled: unencrypted, behind Cloudflare, with a free Let's Encrypt certificate issued automatically, or with a custom certificate pasted by hand.

If the server has more than one allocation (IP:port), each domain can point to a different one, so a single server can expose several independent apps under different domains. If the node has domain ownership verification enabled, the domain waits for a TXT record before it's applied (see Usage: end user).

All the heavy lifting (writing the nginx config, reloading it, requesting the certificate) is done by Wings on the corresponding node. The panel only orchestrates and stores state.

Pieces involved

  • Panel (Laravel): the interface, validations, permissions, and the background task queue that orchestrates each change.
  • Wings (Go): the agent that already runs on every node, authenticated with the panel through the node's token. The addon adds a handful of its own endpoints to manage domains.
  • nginx: the actual proxy engine. Wings keeps one configuration file per domain and reloads it when needed.
  • certbot: issues and revokes Let's Encrypt certificates when the user picks that mode.

How creating a domain flows, roughly

  1. The user fills out the form on the Proxy tab and submits it.
  2. The panel validates the domain format and the user's permission, checks the node's configuration (whether the proxy is enabled, which SSL modes it allows, domain limits per server), and resolves which server allocation it points to.
  3. If the node requires domain ownership verification, the domain waits for a DNS record (see the next section) before the rest of the flow continues.
  4. The panel queues a background task that asks Wings, over an authenticated connection, to configure the domain.
  5. Wings validates that the domain name is a safe public hostname (rejecting anything that could break the nginx config), writes the corresponding configuration file, and reloads nginx.
  6. Depending on the mode chosen: it issues a Let's Encrypt certificate, writes the certificate sent by the panel (custom mode), or generates a self-signed one if the domain is behind Cloudflare.
  7. Wings confirms nginx actually loaded the new domain (not just that it accepted the config) before reporting success.
  8. The panel marks the domain as active; the Proxy tab reflects it automatically within the next few seconds.

Deletion follows the reverse path: the panel frees up the name immediately and queues a task that asks Wings to remove the configuration and revoke the corresponding certificate.

Domain ownership verification (when the node requires it)

The domain is created in a waiting state with a randomly generated token. The user has to publish that token as a TXT record in the domain's DNS and confirm it from the Proxy tab. The panel resolves the DNS and compares the value securely; if it matches, only then does the domain continue the normal application flow. This verification is resolved entirely from the panel, with no changes needed on the Wings side.

Next: Requirements →