Dokku Deploys To Every Domain and Subdomain

Nginx will forward everything to the last server block config it can find. You need to have a default server set in nginx’s config and make sure it returns 404. See this StackOverflow answer on how to configure this.

Dokku default site:

By default, Dokku will route any received request with an unknown HOST header value to the lexicographically first site in the nginx config stack. If this is not the desired behavior, you may want to add the following configuration to the global nginx configuration.

Create the file at /etc/nginx/conf.d/00-default-vhost.conf:

server {
  listen 80 default_server;
  listen [::]:80 default_server;

  server_name _;
  return 410;
  log_not_found off;
}

Make sure to reload nginx after creating this file by running service nginx reload.

This will catch all unknown HOST header values and return a 410 Gone response. You can replace the return 410; with return 444; which will cause nginx to not respond to requests that do not match known domains (connection refused).

The configuration file must be loaded before /etc/nginx/conf.d/dokku.conf, so it can not be arranged as a vhost in /etc/nginx/sites-enabled that is only processed afterwards.

Alternatively, you may push an app to your Dokku host with a name like “00-default”. As long as it lists first in ls /home/dokku/*/nginx.conf | head, it will be used as the default nginx vhost.