Your service on a client's domain: CNAME, certbot, and 300 lines of Go instead of ACME on-demand

This article explores the technical implementation of custom domain support for SaaS services. The author details the challenges of managing CNAME records, automating SSL certificate issuance and renewal, and maintaining infrastructure security. Rather than relying on complex ACME on-demand solutions, the author proposes a custom implementation using approximately 300 lines of Go code. Key topics include mitigating risks from malicious domain entries and configuring X-Forwarded-For headers to prevent internal endpoints from becoming publicly exposed. This guide is highly relevant for developers tasked with scaling SaaS platforms and integrating custom domain functionality into their architecture, offering a pragmatic, lightweight approach to solving common infrastructure hurdles without unnecessary overhead.