I moved a staging environment off the cloud in one evening

Description and use

Migrated Assemblyl staging from cloud to a home Proxmox cluster in one evening: flattened tenant namespace, single wildcard cert, Traefik routing, Cloudflare Tunnel, no monthly costs.

Problem

Staging ran on paid cloud services, incurring unnecessary monthly costs while a self-hosted homelab existed.

Outcome

Migrated staging to a self-hosted environment in ~50 minutes, eliminating monthly cloud costs and simplifying tenant routing with a single wildcard certificate.

Workflow

• 1. Flatten tenant namespace to {tenant}-as.example.com to keep wildcard one level deep.
• 2. Create per-tenant DNS records via API.
• 3. Configure Traefik with a HostRegexp rule matching tenant names and a single wildcard certificate.
• 4. Enable passHostHeader to preserve tenant host header.
• 5. Pre-warm certificate by curling a non-existent tenant name to trigger DNS challenge.
• 6. Deploy four services to self-hosted platform layer, each pointing to a monorepo directory.
• 7. Move CI to a self-hosted runner on the same cluster.
• 8. Verify public access via Cloudflare Tunnel without port forwarding.

Evidence

The complication was that staging had to stay multi-tenant. Every tenant gets their own subdomain.

Source

The fix was to flatten the namespace Keep the wildcard one level deep by moving the tenant name into the label rather than in front of it: {tenant}-as.example.com

Source

Four applications on the self-hosted platform layer, each pointing at a different directory of the same monorepo, each with its own domain and its own build. All four went from "create application" to serving in about fifty minutes.

Source