Admin: DDNS
Manage Hub DDNS domains and view all allocated subdomains across organizations
What you see
URL: /dashboard/admin/ddns (requires admin or superadmin role)
The Admin DDNS page provides management of the DDNS domains that Hub offers to users, and a global view of all subdomain allocations across organizations. The page has two tabs: Domains and Subdomains.
Domains tab
The Domains tab lists every DDNS domain. That includes the platform pool offered to all users, and the Cloudflare zones that organizations brought themselves ("Your domains", Pro and Enterprise). Each domain is backed by a Cloudflare zone. Tokens are stored encrypted and are never shown on this page.
Each domain card shows:
| Field | Description |
|---|---|
| Domain | The parent domain name |
| Status | Enabled or Disabled |
| Org: name | Shown on organization-owned domains: the organization that brought the zone |
| Credential | Verified ✓ (date), Token rejected, Unverified, or Token removed (see below) |
| Cloudflare Zone ID | The Cloudflare zone identifier |
| Subdomains | Usage count out of maximum (e.g. 42 / 3000) with a progress bar; organization domains show "(no limit)" |
| Added | Date the domain was registered in Hub |
Subdomains tab
The Subdomains tab shows a table of all subdomain allocations across all organizations.
| Column | Description |
|---|---|
| FQDN | Full domain name (e.g. swift17.example.com) |
| Organization | Name of the organization that owns the subdomain |
| IP | Current IP address the subdomain resolves to, or "--" if not set |
| Type | auto (system-generated slug) or custom (user-chosen slug) |
| Status | Current DNS status |
| Created | Date the subdomain was allocated |
Available actions
| Action | Where | What it does |
|---|---|---|
| Add Domain | Domains tab header | Opens a modal to register a new Cloudflare-managed domain |
| Enable/Disable | Per domain card | Toggles whether the domain accepts new subdomain allocations. On an organization domain, a disable you make here can't be undone by the organization: they see Disabled by PodWarden until an admin enables it again. |
| Delete | Trash icon per platform domain card | Removes the domain. Only works if no subdomains are allocated. Not offered on organization domains. |
Platform admins can view and disable organization-owned domains, but cannot change their token or zone, or delete them. The organization manages those from its own DDNS page. | Switch tabs | Tab buttons | Toggle between Domains and Subdomains views |
Add domain modal
| Field | Description |
|---|---|
| Domain | The domain name |
| Cloudflare Zone ID | Zone identifier from the Cloudflare dashboard |
| Cloudflare API Token | Token with Zone → DNS → Edit (and ideally Zone → Zone → Read) on the zone. Hub verifies it (token active, zone matches, temporary TXT record written and deleted) before saving, and stores it encrypted. |
| Max Subdomains | Maximum number of subdomains allowed under this domain (default: 3000) |
Status badges
Domain status
| Badge | Meaning |
|---|---|
| Enabled | Domain is active and accepts new subdomain allocations |
| Disabled | Domain is paused. Existing subdomains continue to work, but no new allocations are allowed. |
Credential status
| Badge | Meaning |
|---|---|
| Verified ✓ (date) | The token passed verification |
| Token rejected | Cloudflare rejected the token, found by a failed IP push or the daily ddns-credential-check job. The last error is shown on the card. |
| Unverified | Stored without verification (operator escape hatch) |
| Token removed | The organization was deleted and its token purged |
| Disabled by PodWarden | An admin disabled this organization domain; the organization cannot resume it |
The ddns-credential-check curator job runs daily at 05:40 UTC. It re-checks every stored token without writing any DNS records, flips a domain between Verified and Token rejected, and writes a ddns_domain_credential_invalid audit entry when a token becomes rejected. To run it on demand, queue a ddns-credential-check job with POST /api/v1/admin/curator/jobs; its result is readable at GET /api/v1/admin/curator/jobs?type=ddns-credential-check.
Subdomain status
| Badge | Meaning |
|---|---|
| Active | DNS record is live and being updated |
| Pending | Subdomain is allocated but DNS record has not been created yet |
| Error | The last DNS update failed |
| Suspended | Subdomain has been suspended |
Related docs
- DDNS -- User-facing subdomain allocation
- Admin Overview -- Admin entry point
- Settings: DDNS -- DDNS configuration on PodWarden instances