Skip to content

Networking & DNS

All project initialization commands follow these security and naming rules:

  1. Interactive Hostname: If no --host-name is provided, LDM will prompt you (defaulting to localhost).
  2. SSL Auto-Enable: If a custom hostname is used (anything other than localhost), LDM automatically enables SSL and routes traffic via port 443.
  3. Explicit Control: You can override the auto-SSL behavior using --ssl or --no-ssl.
  4. Port Mapping: When SSL is active, the direct port 8080 mapping is removed to ensure all traffic passes through the secure Traefik proxy.

Custom hostname without SSL

Rule 2 is a default, not a constraint: --no-ssl, and a .ldmp package manifest that declares ssl: "false" alongside a custom host_name, both produce a custom hostname with SSL off. That combination is supported, and LDM prints a warning at start-up saying what you get:

  • No proxy fronts the project. Traefik routing labels are emitted only for SSL projects and are TLS-only (entrypoints=websecure), so there is no plain HTTP router for the hostname.
  • The access URL keeps Liferay's own port — http://my-project.local:8080, not http://my-project.local. Point the hostname at the machine in your hosts file and keep the port.
  • ldm info, ldm list and the readiness banner all report that same URL; they share one resolver, so they cannot disagree (LDM-#1568).

Re-run with --ssl to serve the same hostname on https://my-project.local through the global proxy instead.

Client Extension Routing & Wildcard SSL

LDM automates the routing and SSL orchestration for both the main Liferay instance and its related Client Extensions using a Wildcard Subdomain Strategy:

  • Predictable Subdomains: Server-Side Client Extensions (SSCE) with a Dockerfile are automatically assigned a unique subdomain based on their ID. For example, if your project host is my-project.local, an extension with ID custom-logic will be accessible at https://custom-logic.my-project.local.
  • Zero-Config HTTPS: LDM generates a single SSL certificate that covers both the main host and its wildcard (e.g., my-project.local and *.my-project.local). This secures all extensions automatically.
  • Automated Routing: Traffic on port 443 is intercepted by the global Traefik proxy and routed to the correct container using SNI (Server Name Indication) and Docker labels.
  • A host port is published only when SSL is off. The global Traefik proxy is provisioned for SSL projects, and the subdomain above is then the way in -- such a project publishes no per-extension host port, because it does not need one. A non-SSL project gets no proxy at all, so each client extension publishes a host port instead and that port is the only way to reach it. The port is the one LDM allocated for that extension and is reported by ldm status; it is no longer rewritten (LDM-#1969 published everything landing on 8080 as a shared 28080, so at most one extension on the whole host could bind it, and LDM-#1985 removed the mapping altogether before restoring it correctly).
  • Liferay Integration: LDM automatically injects LIFERAY_WEB_SERVER_HOST and other necessary properties into Liferay to ensure it can communicate seamlessly with its client extension subdomains.

Tip

DNS Resolution: Standard /etc/hosts files do not support wildcards. However, LDM's ldm fix-hosts [project] and ldm doctor --fix-hosts commands are intelligent—they scan your project for active client extensions and automatically append entries for both the main hostname and all required subdomains (e.g., custom-logic.my-project.local) to your hosts file.

Last Updated: 2026-09-25 | Last Reviewed: 2026-09-25