domainCtrl provides a simple web dashboard to monitor and manage your domain records. It automatically updates your DNS 'A' records to match your home's dynamic public IP and uses Let's Encrypt to create and renew SSL certificates for your services.

Note: domainCtrl is in active development and should be used with caution.

Note: domainCtrl currently only supports AWS Route 53 (more providers coming soon).

GitHub: thebronway/domainCtrl
Docker Hub: thebronway/domainctrl Roadmap: See planned features in the Project Roadmap.
Changelog: Review past releases in the Changelog.

Mobile

• Dynamic DNS (DDNS): Automatically checks your public IP and updates DNS records if they change.
• SSL Management: Wraps Certbot to handle creation and renewal of certificates using the DNS-01 challenge (Wildcard supported).
• Web Dashboard: A clean, responsive UI to view the status of all your domains at a glance.
• Settings: Configure domains, notifications, timezones, and log retention directly from the browser.
• Notifications: Get alerts via Discord, Slack, Telegram, Email (SMTP), and more.
• Mobile Friendly: Fully responsive design.

1. SSL Lifecycle: This app manages the full lifecycle of certificates. It can only renew certs it created. Existing certs should be replaced by ones generated here for auto-renewal.
2. Authentication: This app has no login. You MUST run this behind a reverse proxy (Nginx, Traefik, etc.) with Basic Auth or SSO to secure the dashboard.

• A domain managed by a supported provider (currently only AWS Route 53).
• API credentials with permissions to modify DNS records.

docker run -d \\
  --name domainctrl \\
  -p 8080:8080 \\
  -v $(pwd)/config:/config \\
  -v $(pwd)/certs:/certs \\
  -v $(pwd)/logs:/logs \\
  -e PROVIDER=Route53 \\
  -e AWS_ACCESS_KEY_ID="YOUR_KEY" \\
  -e AWS_SECRET_ACCESS_KEY="YOUR_SECRET" \\
  -e TZ=America/New_York \\
  --restart unless-stopped \\
  thebronway/domainctrl:latest

1. Open http://localhost:8080.
2. Go to Settings.
3. Add domains and toggle features (DDNS, SSL, Notifications).
4. Save Changes.

The application is configured primarily via the PROVIDER variable.

If PROVIDER=Route53:

Secrets for notifications can be configured in the Settings UI or passed as environment variables.

Check out my other projects at brian.conway.im.
Find this or any of my other projects useful or helpful? Support my work (Buy me a coffee).

This project was coded with AI assistance, but fully reviewed, tested, and approved by hand. See AIACKNOWLEDGMENT.md for details.

This software is provided "as is", without warranty of any kind, express or implied.

Last updated: 2026-02-27
Current Version: v0.7.3

This document tracks past changes starting with v0.6.5

• Security and Stability Fixes

Last updated: 2026-02-27
Current Version: v0.7.3

This document tracks planned improvements, enhancements, and technical debt for domainCtrl. It serves as a living guide for development priorities.

Focus: Cleaning up the user interface and improving dashboard usability.

• Filter & Navigation Improvements
  • Goal: Add up/down/reset behavior to the domain filter, and ensure the reset button only appears when actively filtering.
  • Value: Makes navigating a large list of domains significantly smoother and more intuitive.
• Light Mode & Log Tweaks
  • Goal: Improve contrast for light mode buttons and transition logs to a cleaner, plain-text format.
  • Value: Enhances readability and makes the dashboard feel more premium and responsive.

Focus: Ensuring backend stability, preventing storage bloat, and adding manual overrides.

• Orphan Data Cleanup
  • Goal: Add a confirmation prompt when deleting a domain, and ensure that deleting a domain completely wipes its associated /certs/ directory, log files, and app_state entries.
  • Value: Prevents storage bloat and avoids Let's Encrypt rate-limiting issues caused by ghost directories left behind on the host machine.
• CSS Organization
  • Goal: Refactor and split the monolithic stylesheet into modular, manageable chunks.
  • Value: Pays down UI technical debt before adding more complex views.
• Add AI usage declration

• Force SSL Renewal Button
  • Goal: Add a --force-renewal action to the UI for edge cases where a certificate is revoked, corrupted, or needs immediate replacement.
  • Value: Gives the user manual override capabilities when Certbot's automatic "skip if not near expiration" logic gets in the way.
• External Certificate Monitoring
  • Goal: Allow users to add a domain for "Monitoring Only." The app fetches the live SSL certificate from the domain's HTTPS endpoint to track expiration dates without managing the DDNS or renewals.
  • Value: Makes the dashboard a single pane of glass for all of a user's domains, even those managed by external load balancers like Traefik or Nginx Proxy Manager.

Focus: Transitioning from a single global DNS provider to a flexible, per-domain architecture.

• Per-Domain Provider Configuration
  • Goal: Move PROVIDER and API credentials out of global environment variables and into the domain-specific JSON settings. Set the default state to a "Blank Canvas" (None).
  • Value: The biggest architectural leap for the app. Allows a user to manage one domain on Route53, and another on Cloudflare, all from the same dashboard.
• New DNS Providers
  • Goal: Add support for Cloudflare, Azure DNS, and Google Cloud DNS. Update the Dockerfile to include the necessary python3-certbot-dns-* plugins.
  • Value: Massively expands the target audience for the app, as Cloudflare is the most popular DNS provider for self-hosters.

Focus: Securing the application for the open web and improving open-source maintainability.

• Code Hardening & Basic Authentication
  • Goal: Add native Basic Auth or a simple password wrapper to the Flask app, alongside input sanitization and general penetration testing.
  • Value: Removes the strict requirement for users to set up a reverse proxy with auth just to use the app safely.
• Git Housekeeping
  • Goal: Create a GitHub Wiki for documentation, and set up Issue/Bug Report templates.
  • Value: Encourages community contributions and cuts down on repetitive support questions.

Focus: Expanding the app to track external services and receive remote updates.

• Inbound API Webhooks (Local/Remote Architecture)
  • Goal: Create secure, API-key-protected endpoints.
  • Value: Allows MSPs or others who have multiple sites to manage everything from one master dashbaord.