Operate Web Fleet

Company subdomains

For organizations running several self-hosted tools, a dedicated subdomain per service is usually the cleanest deployment model.

Recommended pattern

company.com
├── webfleet.company.com   → Web Fleet
├── trestle.company.com    → Trestle
├── cortex.company.com     → Cortex
└── watchpost.company.com  → Watchpost

These products remain independent. They do not need to share a server, database or authentication system merely because they use sibling subdomains.

DNS

Create an A/AAAA record for webfleet.company.com pointing to the reverse proxy, or a suitable CNAME where your DNS/provider architecture supports it.

webfleet.company.com.  A  203.0.113.20

Reverse proxy

Terminate HTTPS at Caddy, nginx or another trusted reverse proxy and forward Web Fleet to its private listen address such as 127.0.0.1:7336. Keep the public hostname stable because analytics properties validate their configured website origins.

Analytics across domains

A website such as www.company.com can send optional analytics events to webfleet.company.com. Web Fleet validates the analytics property and allowed website origin; the tracker does not require Web Fleet to be hosted on the monitored site's machine.

Set up Web Fleet on `webfleet.company.com`

Create DNS. Add an A/AAAA record for webfleet.company.com pointing at the server running your reverse proxy.
Keep Web Fleet private. Run Web Fleet on the loopback default 127.0.0.1:7336; do not expose that application port publicly when the proxy is the ingress.
Choose a proxy. Follow the Caddy or nginx configuration.
Verify HTTPS. Load https://webfleet.company.com/healthz and require a successful response before proceeding.
Complete first-run setup. Open https://webfleet.company.com, choose SQLite or PostgreSQL, follow any restart instruction, then create the administrator account.
Add websites. Monitoring works remotely; the monitored websites do not need to live on the Web Fleet server.
Add analytics only where wanted. Enable a property's tracker and allow its website origin. Analytics remains opt-in.

Caddy

webfleet.company.com {
    reverse_proxy 127.0.0.1:7336
}

nginx

server {
    listen 443 ssl;
    server_name webfleet.company.com;

    location / {
        proxy_pass http://127.0.0.1:7336;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

If DNS resolves but HTTPS does not, check ports 80/443 and certificate issuance. If HTTPS works but Web Fleet returns 502/504, test curl http://127.0.0.1:7336/healthz on the server before changing DNS.