Build Custom Domain Mapping for SaaS

CREATE TABLE custom_domains (
  id                 uuid PRIMARY KEY DEFAULT gen_random_uuid(),
  tenant_id          text NOT NULL,
  domain             text NOT NULL,
  status             text NOT NULL DEFAULT 'pending_dns' CHECK (status IN ('pending_dns', 'active')),
  verification_token text NOT NULL,
  verified_at        timestamptz,
  created_at         timestamptz NOT NULL DEFAULT now()
);
-- Several tenants may claim a domain, but only one can have it active.
CREATE UNIQUE INDEX custom_domains_active_domain ON custom_domains (domain) WHERE status = 'active';
CREATE INDEX custom_domains_tenant ON custom_domains (tenant_id);

// src/domains.ts — domain claims, DNS verification and host -> tenant lookup
import { randomBytes } from "node:crypto";
import { resolveCname, resolve4, resolveTxt } from "node:dns/promises";
import { Pool } from "pg";
import { Redis } from "ioredis";
import { z } from "zod";

export const pool = new Pool({ connectionString: process.env.DATABASE_URL });
const redis = new Redis(process.env.REDIS_URL!);

const PLATFORM_DOMAIN = process.env.PLATFORM_DOMAIN ?? "builder.io";
const CNAME_TARGET = process.env.CNAME_TARGET ?? `custom.${PLATFORM_DOMAIN}`;
const SERVER_IPS = (process.env.SERVER_IPS ?? "").split(",").filter(Boolean);

// Lowercase hostname with at least one dot; no scheme, port, path, IP literal or platform subdomain.
export const DomainSchema = z
  .string()
  .trim()
  .toLowerCase()
  .max(253)
  .regex(/^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/, "Invalid domain")
  .refine((d) => d !== PLATFORM_DOMAIN && !d.endsWith(`.${PLATFORM_DOMAIN}`), "Reserved domain");

export async function addCustomDomain(tenantId: string, input: string) {
  const domain = DomainSchema.parse(input);
  const token = `builder-verify-${randomBytes(24).toString("base64url")}`;
  const { rows } = await pool.query(
    `INSERT INTO custom_domains (tenant_id, domain, verification_token)
     VALUES ($1, $2, $3) RETURNING id`,
    [tenantId, domain, token],
  );
  return {
    id: rows[0].id as string,
    domain,
    dns: [
      { type: "CNAME", host: domain, value: CNAME_TARGET },   // apex domains: use A/ALIAS records instead
      { type: "TXT", host: `_builder-verification.${domain}`, value: token },
    ],
  };
}

export async function verifyDomain(tenantId: string, id: string) {
  const { rows } = await pool.query(
    "SELECT domain, verification_token FROM custom_domains WHERE id = $1 AND tenant_id = $2",
    [id, tenantId],
  );
  if (!rows[0]) throw new Error("Domain not found");
  const { domain, verification_token: token } = rows[0];

  const routed = await pointsAtUs(domain);
  const owned = await resolveTxt(`_builder-verification.${domain}`)
    .then((records) => records.some((chunks) => chunks.join("") === token))
    .catch(() => false);
  if (!routed || !owned) return { routed, owned, active: false };

  // The partial unique index allows only one active claim per domain; the loser gets an error here.
  await pool.query(
    "UPDATE custom_domains SET status = 'active', verified_at = now() WHERE id = $1",
    [id],
  );
  await redis.set(`domain:${domain}`, tenantId, "EX", 300);
  return { routed, owned, active: true };
}

async function pointsAtUs(domain: string) {
  const cname = await resolveCname(domain).catch(() => []);
  if (cname.some((r) => r.replace(/\.$/, "").toLowerCase() === CNAME_TARGET)) return true;
  const a = await resolve4(domain).catch(() => []);
  return a.some((ip) => SERVER_IPS.includes(ip));
}

// Called on every request (and by Caddy's ask endpoint), so keep it to one cache hit or one indexed query.
export async function resolveTenant(rawHost: string): Promise<string | null> {
  const host = rawHost.toLowerCase().replace(/:\d+$/, "");
  const cached = await redis.get(`domain:${host}`);
  if (cached) return cached;

  const { rows } = await pool.query(
    "SELECT tenant_id FROM custom_domains WHERE domain = $1 AND status = 'active'",
    [host],
  );
  if (!rows[0]) return null;
  await redis.set(`domain:${host}`, rows[0].tenant_id, "EX", 300);
  return rows[0].tenant_id;
}

export async function removeDomain(tenantId: string, id: string) {
  const { rows } = await pool.query(
    "DELETE FROM custom_domains WHERE id = $1 AND tenant_id = $2 RETURNING domain",
    [id, tenantId],
  );
  if (rows[0]) await redis.del(`domain:${rows[0].domain}`);
}

// src/server.ts — three Hono apps: customer API, Caddy's "ask" endpoint, and the tenant site
import { Hono } from "hono";
import { serve } from "@hono/node-server";
import { ZodError } from "zod";
import { addCustomDomain, verifyDomain, resolveTenant, DomainSchema } from "./domains";

// 1. Customer-facing API (put your real auth middleware in front; tenantId must come from the session)
const api = new Hono<{ Variables: { tenantId: string } }>();
api.use("*", async (c, next) => {
  c.set("tenantId", "tenant-123"); // placeholder for your session lookup
  await next();
});
api.onError((err, c) =>
  err instanceof ZodError
    ? c.json({ error: err.issues[0].message }, 400)
    : c.json({ error: err.message }, 500),
);
api.post("/domains", async (c) => {
  const { domain } = await c.req.json();
  return c.json(await addCustomDomain(c.get("tenantId"), domain), 201);
});
api.post("/domains/:id/verify", async (c) =>
  c.json(await verifyDomain(c.get("tenantId"), c.req.param("id"))),
);

// 2. Caddy asks here before it requests a certificate. Internal only: bound to 127.0.0.1 below.
const internal = new Hono();
internal.get("/ask", async (c) => {
  const parsed = DomainSchema.safeParse(c.req.query("domain"));
  const tenant = parsed.success ? await resolveTenant(parsed.data) : null;
  return c.body(null, tenant ? 200 : 404);
});

// 3. The tenant site: Caddy forwards the customer's Host header unchanged
const site = new Hono<{ Variables: { tenant: string } }>();
site.use("*", async (c, next) => {
  const tenant = await resolveTenant(c.req.header("host") ?? "");
  if (!tenant) return c.text("Unknown domain", 404);
  c.set("tenant", tenant);
  await next();
});
site.get("/", (c) => c.text(`Site for ${c.get("tenant")}`));

const bind = { hostname: "127.0.0.1" };
serve({ fetch: api.fetch, port: 3001, ...bind });
serve({ fetch: internal.fetch, port: 3002, ...bind });
serve({ fetch: site.fetch, port: 3003, ...bind });

{
	email ops@builder.io
	on_demand_tls {
		ask http://127.0.0.1:3002/ask
	}
}

# Any hostname that the ask endpoint approves gets a certificate on its first TLS handshake
https:// {
	tls {
		on_demand
	}
	reverse_proxy 127.0.0.1:3003
}