feat(settings): add flat public hostname strategy

(cherry picked from commit 11482bd)

Author: bherila

CHANGELOG.md

@@ -8,7 +8,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Added
--
+- **Configurable public hostname strategy**: platform settings now support
+  `public_hostnames` templates for generated environment, deployment, and
+  public compose-service routes. Operators can switch to the `flat` strategy to
+  keep generated hostnames one label beneath `preview_domain` for proxied
+  wildcard TLS providers such as Cloudflare Universal SSL; labels are sanitized
+  and truncated with stable short-hash suffixes when they exceed DNS limits.
 
 ### Changed
 -

crates/temps-config/src/handler.rs

@@ -16,8 +16,8 @@ use temps_core::error_builder::ErrorBuilder;
 use temps_core::{
     problemdetails::Problem, AiConfigSettings, AppSettings, AuditContext, AuditLogger,
     AuditOperation, ContainerLogSettings, DiskSpaceAlertSettings, LetsEncryptSettings,
-    MetricsStoreKind, RateLimitSettings, RequestMetadata, ScreenshotSettings,
-    SecurityHeadersSettings,
+    MetricsStoreKind, PublicHostnameSettings, PublicHostnameStrategy, RateLimitSettings,
+    RequestMetadata, ScreenshotSettings, SecurityHeadersSettings,
 };
 use tracing::{error, info};
 use utoipa::{OpenApi, ToSchema};
@@ -80,6 +80,7 @@ pub struct AppSettingsResponse {
     pub external_url: Option<String>,
     pub internal_url: Option<String>,
     pub preview_domain: String,
+    pub public_hostnames: PublicHostnameSettings,
 
     // Screenshot settings
     pub screenshots: ScreenshotSettings,
@@ -239,6 +240,7 @@ impl From<AppSettings> for AppSettingsResponse {
             external_url: settings.external_url,
             internal_url: settings.internal_url,
             preview_domain: settings.preview_domain,
+            public_hostnames: settings.public_hostnames,
             screenshots: settings.screenshots,
             letsencrypt: settings.letsencrypt,
             dns_provider: DnsProviderSettingsMasked {
@@ -350,6 +352,8 @@ impl AppSettingsResponse {
         crate::disk_status::DiskSpaceAlert,
         crate::disk_status::DiskSpaceCheckResult,
         ContainerLogSettings,
+        PublicHostnameSettings,
+        PublicHostnameStrategy,
         DnsProviderSettingsMasked,
         DockerRegistrySettingsMasked,
         AgentSandboxSettingsMasked,
@@ -475,6 +479,21 @@ fn preserve_self_recorded_fields(incoming: &mut AppSettings, current: &AppSettin
     incoming.console_version = current.console_version.clone();
 }
 
+fn normalize_public_hostname_templates(settings: &mut AppSettings) {
+    fn normalize_template(template: &mut Option<String>) {
+        if let Some(value) = template.take() {
+            let trimmed = value.trim().to_string();
+            if !trimmed.is_empty() {
+                *template = Some(trimmed);
+            }
+        }
+    }
+
+    normalize_template(&mut settings.public_hostnames.environment_template);
+    normalize_template(&mut settings.public_hostnames.service_template);
+    normalize_template(&mut settings.public_hostnames.deployment_template);
+}
+
 /// Update application settings
 #[utoipa::path(
     tag = "Settings",
@@ -699,6 +718,8 @@ async fn update_settings(
         }
     }
 
+    normalize_public_hostname_templates(&mut settings);
+
     match app_state.config_service.update_settings(settings).await {
         Ok(_) => {
             let audit = SettingsUpdatedAudit {

crates/temps-config/src/service.rs

@@ -316,9 +316,6 @@ impl ServerConfig {
     }
 }
 
-// Default domain for local development (resolves to 127.0.0.1)
-pub const DEFAULT_LOCAL_DOMAIN: &str = "localho.st";
-
 /// Service that provides centralized access to configuration paths and settings
 /// Handles path resolution, persistent settings, and ensures consistency across the application
 pub struct ConfigService {
@@ -697,7 +694,7 @@ impl ConfigService {
     }
 
     /// Get the full deployment URL for a given deployment slug
-    /// Always returns [protocol]://{slug}.{preview_domain}
+    /// using the configured public hostname strategy.
     /// Get the deployment URL by deployment ID
     pub async fn get_deployment_url(
         &self,
@@ -739,28 +736,22 @@ impl ConfigService {
             ("https".to_string(), None)
         };
 
-        // Use preview_domain if set, otherwise fallback to DEFAULT_LOCAL_DOMAIN
-        let preview_domain = if !settings.preview_domain.is_empty() {
-            settings.preview_domain.trim_start_matches("*.").to_string()
-        } else {
-            DEFAULT_LOCAL_DOMAIN.to_string()
-        };
+        let hostname = settings
+            .public_hostnames
+            .deployment_hostname(&settings.preview_domain, deployment_slug);
 
-        // Construct the URL as [protocol]://{slug}.{preview_domain}[:port]
+        // Construct the URL as [protocol]://{host}[:port]
         // Only include port if it's non-standard (not 443 for https, not 80 for http)
         let url = if let Some(port) = port {
             let is_standard_port =
                 (protocol == "https" && port == 443) || (protocol == "http" && port == 80);
             if is_standard_port {
-                format!("{}://{}.{}", protocol, deployment_slug, preview_domain)
+                format!("{}://{}", protocol, hostname)
             } else {
-                format!(
-                    "{}://{}.{}:{}",
-                    protocol, deployment_slug, preview_domain, port
-                )
+                format!("{}://{}:{}", protocol, hostname, port)
             }
         } else {
-            format!("{}://{}.{}", protocol, deployment_slug, preview_domain)
+            format!("{}://{}", protocol, hostname)
         };
 
         Ok(url)

crates/temps-core/src/app_settings.rs

@@ -2,6 +2,8 @@ use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use utoipa::ToSchema;
 
+use crate::PublicHostnameSettings;
+
 /// Application settings stored in the database
 /// All fields have sensible defaults for easy onboarding
 #[derive(Debug, Clone, Serialize, ToSchema, Deserialize)]
@@ -17,6 +19,7 @@ pub struct AppSettings {
     /// `external_url`, which is the public-facing address.
     pub internal_url: Option<String>,
     pub preview_domain: String,
+    pub public_hostnames: PublicHostnameSettings,
 
     // Screenshot settings
     pub screenshots: ScreenshotSettings,
@@ -534,6 +537,7 @@ impl Default for AppSettings {
             external_url: None,
             internal_url: None,
             preview_domain: DEFAULT_LOCAL_DOMAIN.to_string(),
+            public_hostnames: PublicHostnameSettings::default(),
             screenshots: ScreenshotSettings::default(),
             letsencrypt: LetsEncryptSettings::default(),
             dns_provider: DnsProviderSettings::default(),

crates/temps-core/src/lib.rs

@@ -14,6 +14,7 @@ pub mod on_demand;
 pub mod openapi;
 pub mod plugin;
 pub mod problemdetails;
+pub mod public_hostname;
 pub mod retry;
 pub mod telemetry;
 pub mod tls;
@@ -48,6 +49,7 @@ pub use error::*;
 pub use error_builder::*;
 pub use jobs::*;
 pub use on_demand::*;
+pub use public_hostname::{PublicHostnameContext, PublicHostnameSettings, PublicHostnameStrategy};
 pub use telemetry::{NoopTelemetryReporter, TelemetryEvent, TelemetryEventKind, TelemetryReporter};
 pub use utils::*;