Linux

It is possible, what you're looking for is a reverse proxy: it's an HTTP server that will listen to the standard ports for HTTP and HTTPS that will redirect traffic to the chosen service based on the domain name or URL.

In your case, every subdomain would point to your VPS's IP and traffic that's for mastodon.example.tld will be seemlesly proxied to your Mastodon container.

Do some research on Caddy or Nginx, and I strongly recommend you learn Docker Compose and Docker networking, it will help you make it easier to maintain everything.

PS: CNAME pointing to A record is the way to go. You can do it one better by having a CNAME entry for *.example.tld, so that you don't have to create a CNAME entry for every new service you deploy, but you better make sure that your reverse proxy won't proxy requests to an unexpected container when requesting a bogus subdomain.

For the web based services the best way would be to put a webserver in front of them to forward traffic to the Docker containers based on the domain. Nginx is popular for this. Personally I use Apache because I know it better.

So Nginx would listen on ports 443 and 80 and all the Docker ports should only be available internally. You can use Let's Encrypt to get free SSL certificates for all your domains.

You can have multiple A records point to the same IP address, yes. Whatever website you're managing your DNS with should allow you to create multiple subdomains as A/AAAA records. You can also (if you wish) use a wildcard to ensure that all subdomains go to your VPS's server.

If you want to run multiple HTTP/HTTPS services on the same IP address (as it looks like you want to do), you'll need to use a reverse proxy like Nginx. It can pattern match on domain names and ensure that traffic for one domain goes to an appropriate port/socket (mastodon.example.com being sent to the mastodon service). It's not possible for DNS to specify port redirection.

Also, you've not mentioned it here, but look into https://letsencrypt.org/ for HTTPS certificates.

Some surface-level info while I'm waiting for my kids to finish the evening ritual: No need for an extra IP or VPS. You can host them all on the same IP and machine, provided there aren't any conflicting port assignments.

In the DNS server, you can enter the various subdomains as CNAME pointing to the A record. The server-software is configured with which hostname it should operate as (For example, HTTP/1.1 has a Host-specification in the initial request, so that one server can host multiple domains on the same IP)

It should be noted that mail servers are indicated by an MX-record. And mailservers should also have a TXT record (SPF record) as part of spam prevention - some SMTP servers query this to ensure that your e-mail actually comes from you and not from someone spoofing the domain.

I used to have a zone file that did roughly what you're trying to do, bit sadly I don't have it anymore. But as you have DNS up and running, I'm sure you'll be able to figure out the rest through checking some examples.

I half-baked an example zone file for you. I haven't tested it, though. It assumes the domain of blargh.com being hosted from an IP of 123.123.123.123:

$TTL 86400
@    IN    SOA   ns1.blargh.com. admin.blargh.com. (
                2024102102 ; Serial (incremented)
                3600       ; Refresh
                1800       ; Retry
                1209600    ; Expire
                86400      ; Minimum TTL
)

; Name servers
@    IN    NS    ns1.blargh.com.
@    IN    NS    ns2.blargh.com.

; A Records
@            IN    A      123.123.123.123
ns1          IN    A      123.123.123.123
ns2          IN    A      123.123.123.123

; CNAME Records
mail         IN    CNAME  blargh.com.
mastodon     IN    CNAME  blargh.com.
matrix       IN    CNAME  blargh.com.

; MX Records
@            IN    MX     10 mail.blargh.com.

; TXT/SPF Record
@            IN    TXT    "v=spf1 mx ~all"

Oh, and some tips:

• Do not enable SMTP-relay on your SMTP server. This opens you up to abuse, and you (probably) don't need it.
• Your DNS server should only talk to strangers about queries about your domain. Otherwise you might be part of a DNS amplification attack.
• I have a personal preference for imap.blargh.com or pop3.blargh.com, combined with smtp.blargh.com, as it makes it easier to deduct the protocol, if you're not supporting imap and pop3. I don't think anyone else but me care, though.

Nginx proxy manager can do all of the routing for you if you are using docker. In a graphical interface without touching config. It’s on top of nginx so you get all its benefits!

You can do this by configuring an HTTP server (e.g. Apache) to listen on port 80 and/or 443 (HTTP and HTTPS standard ports, respectively) and select which site to serve based on the name of the site requested. Apache documentation for this feature is here: https://httpd.apache.org/docs/2.4/vhosts/name-based.html

Note the sample config snippet showing how to set up a simple static site serving both www.example.com and other.example.com using ServerName in a VirtualHost to select between them.

You can also have Apache match a pattern in the URL and reverse proxy to another HTTP server -- that can just be another program on the same computer listening on a different port, or could be on another computer entirely. See the simple reverse proxy config example on this page for a starting point: https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html (Note also that you probably don't need anything further down that page -- e.g. the load balancer and failover stuff is not likely to be useful to you for a small personal project.)

Other popular HTTP servers can do this too; I just happen to have done it with Apache before.

Hello my ADHD amigo! I see you have been taken care of quite well by the other comments. You guys are all awesome.

But yeah it's just a reverse proxy that you need and most common is nginx or apache to implement it.

I switched to a container running nginx proxy manager and haven't looked back yet. I learned a whole lot setting up my proxy and TLS manually but now it's really nice to be able to let the tool do its thing.

Yes. As long as you have enough system resources, you can run whatever. If you want to refer to each service by an A record in DNS, just put a reverse proxy out in front. Otherwise, you can just refer to it's forwarded port from the container if you wish.

I dont really have the time to ezplain how (on break), but you can do everything you're askijg without too much trouble.