Skip to main content

​
Subdomains

Every Hubify workspace gets a personal subdomain at yourname.hubify.com. This is your workspace’s permanent address — where your dashboard lives, where your agent is reachable, and where your terminal is accessible.

​
How Subdomains Work

The subdomain system is built on three components:
1

Wildcard DNS

A wildcard DNS record routes all *.hubify.com traffic to the Hubify proxy:
*.hubify.com  CNAME  proxy.fly.io
This means any subdomain — houston.hubify.com, research.hubify.com, bamf.hubify.com — resolves to the same proxy entry point.
2

Caddy Reverse Proxy

A Caddy reverse proxy inspects the SNI (Server Name Indication) of each incoming TLS connection and routes traffic to the correct Fly.io machine. Each workspace has its own machine, and Caddy knows which machine belongs to which subdomain.
3

Automatic HTTPS

SSL certificates are provisioned automatically via Let’s Encrypt using Caddy’s built-in ACME support. Wildcard SSL covers all *.hubify.com subdomains. Each workspace gets its own certificate, and renewal is handled automatically.

​
Subdomain Rules

When you create a workspace, you choose a subdomain. These rules apply:
RuleDetails
CharactersLowercase letters (a-z), numbers (0-9), and hyphens (-) only
Length3 to 30 characters
FormatMust start with a letter or number (not a hyphen)
UniquenessMust be globally unique across all Hubify workspaces
ImmutableCannot be changed after deployment
The validation regex: 
/^[a-z0-9][a-z0-9-]{2,29}$/
Subdomains cannot be changed after a workspace is deployed. If you need a different subdomain, create a new workspace with the desired name. Your data can be migrated between workspaces.

​
Reserved Subdomains

The following subdomains are blocked and cannot be claimed by users: 
www, api, app, docs, admin, blog, help, support, status,
mail, smtp, ftp, ssh, staging, dev, test, demo, proxy,
dashboard, console, panel, manage, auth, login, signup,
billing, account, settings, internal, system, root, hub

​
Internal Routing

Once traffic reaches your workspace machine, nginx handles routing to the correct internal service:
PortServiceAccess Path
80nginx (reverse proxy)All incoming traffic enters here
3000OpenClaw gatewayAI agent — /api/* routes and agent communication
8080ttyd terminalLive terminal — proxied at /terminal
4000Stats serverAuth validation and health checks

​
Routing Map

yourname.hubify.com/            --> nginx:80 --> Next.js dashboard
yourname.hubify.com/chat        --> nginx:80 --> dashboard chat interface
yourname.hubify.com/terminal    --> nginx:80 --> ttyd:8080
yourname.hubify.com/files       --> nginx:80 --> file browser
yourname.hubify.com/api/*       --> nginx:80 --> OpenClaw gateway:3000
All internal service-to-service communication happens over localhost. External traffic only enters through nginx on port 80.

​
Network Isolation

Each workspace gets its own isolated Fly.io 6PN private network: 
Network: user-{username}-net
Key properties of the isolated network:
  • No cross-workspace access — workspace A cannot reach workspace B over the private network
  • Dedicated machine — each workspace runs on its own Fly.io machine (no shared filesystem)
  • Isolated volume — the 10GB persistent volume at /data is exclusive to the workspace
  • Fly secrets — API keys are stored as Fly secrets and never written to disk
Even if two workspaces belong to the same user (e.g., houston.hubify.com and research.hubify.com), they are fully isolated at the infrastructure level. Sharing between workspaces happens through the Convex intelligence layer, not at the network level.

​
Multiple Subdomains Per Account

One Hubify account can own multiple workspaces, each with its own subdomain: 
houston.hubify.com       --> Personal OS (MyOS template)
bamf.hubify.com          --> Agency operations (Founder OS template)
research.hubify.com      --> Deep research (Research OS template)
clientname.hubify.com    --> Client delivery (Client OS template)
Each is a fully separate workspace — separate Fly.io machine, separate Convex hub, separate persistent volume. They can optionally share the vault and intelligence layer through workspace settings.

​
Custom Domains

Custom domain support is planned. The ability to point your own domain (e.g., ai.yourcompany.com) to your Hubify workspace is on the roadmap. Currently, all workspaces are accessible at *.hubify.com subdomains.
When available, custom domains will support:
  • CNAME or A record pointing to Hubify’s proxy
  • Automatic SSL provisioning via Let’s Encrypt
  • Both root domains and subdomains (e.g., ai.yourcompany.com)
  • Custom domain alongside the existing *.hubify.com subdomain (both work simultaneously)

​
DNS Propagation

After creating a workspace, the subdomain is available immediately — there is no DNS propagation delay because all *.hubify.com subdomains share the same wildcard DNS record. The Caddy proxy learns about new workspaces through its configuration and begins routing traffic as soon as the machine is provisioned.

​
Next Steps

Cloud Workspace

What runs inside your workspace

Workspace Security

Authentication and isolation details

Infrastructure

Full infrastructure architecture

Workspace Modes

Guided, Power, and Open modes