End User Usage

Adding a domain

  1. Go to the server → Proxy tab (link icon 🔗, next to Backups).
  2. Click New Domain.
  3. Fill out the form:
    • Domain name: the domain must already have an A record pointing at the node's public IP before entering it here. If it doesn't resolve yet:
      • In None or Cloudflare mode: traffic simply won't arrive until DNS propagates.
      • In Let's Encrypt mode: certificate issuance will fail (certbot can't complete the HTTP-01 challenge without DNS resolved).
    • Port (only shown if the server has more than one allocation): which server IP:port this domain points to. For example, with a server that has 25565 running one app and 25566 a completely separate one, a domain can be created for each by picking the corresponding port here. If left untouched, it uses the server's primary allocation (the usual default behavior).
    • SSL mode: None, Cloudflare, Let's Encrypt, or Custom certificate (paste your own certificate and key). See the details of each mode in SSL modes. The backend rejects any mode the node administrator has blocked, even though the modal always shows all four options.
  4. Click Create Domain.

What to expect after creating a domain

The domain shows up in the list with a status:

  • ● Awaiting DNS: only shows up if the node administrator turned on domain ownership verification. See the next section.
  • ● Pending (spinning icon): the job hasn't run yet or is currently running. The list polls automatically every 10 seconds, no need to refresh the page by hand.
  • ● Active: the proxy is now working on the node. If the node administrator turned on "Show nginx config path", the path of the generated .conf is also shown below the domain name (only visible on medium/large screens); by default that option is off and nothing shows up there.
  • ⚠ Error: something failed. The error message shows up truncated below the domain; hovering over it (tooltip) shows the full text. See Troubleshooting to interpret the most common messages.

If a domain stays in Pending for more than a minute or two, it almost always means there's no queue worker running on the panel; that's something the administrator needs to fix, not the end user.

Verifying domain ownership

If the node administrator turned on "Require domain ownership verification", a new domain isn't applied right away: it stays in Awaiting DNS and a box appears below the name with a TXT record to publish, something like:

ini
_pawproxy-verify.mydomain.com = "a1b2c3..."

Steps:

  1. Go to the domain's DNS panel (outside Pterodactyl: Cloudflare, Namecheap, etc.) and create a TXT record with that exact name and value.
  2. Wait for it to propagate (usually minutes, sometimes longer depending on the provider).
  3. Go back to the Proxy tab and click Verify now.
  4. If the record still isn't visible, the button shows an error asking you to retry in a bit. There's no need to delete and recreate the domain, you can retry as many times as needed.
  5. As soon as verification finds the TXT record with the correct value, the domain moves to Pending and continues the normal application flow on Wings.

Deleting a domain

  1. In the domain's row, click the trash icon.
  2. Confirm in the modal ("Delete this domain? Wings will remove the nginx configuration from the node and revoke the certificate (if any). This cannot be undone.").
  3. The delete button is disabled while the domain is in Pending status.

Deletion is immediate in the database (the record is removed, it doesn't stay "soft deleted"), but the actual cleanup on the node (removing the .conf, revoking the certificate, reloading nginx) runs asynchronously just like creation does.

Limits a user might run into

  • "This server has reached the maximum of N domains.": the node admin set a cap on domains per server.
  • "The domain 'x' is already in use on this panel.": that domain is already assigned to another server (or the same one). Domains are unique across the whole panel, not per server.
  • "Let's Encrypt SSL mode is not enabled for this node." / "Cloudflare SSL mode is not enabled for this node." / "Custom SSL certificates are not enabled for this node.": the node admin blocked that specific mode.
  • "A certificate and private key are required for custom SSL mode.": the certificate or key (or both) is missing when choosing Custom certificate mode.
  • "The selected network allocation does not belong to this server.": this shouldn't ever show up through the normal UI (the port selector only lists the server's own allocations), only if the API is called directly with someone else's allocation_id.
  • "The node hosting this server does not have the domain proxy feature enabled.": the admin hasn't set up the proxy for that node yet. The user can't fix this on their own, they have to ask the administrator to enable it.

Next: SSL modes in detail →