From 971512b935a323de1b4839f4877edda2927fe1e1 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Mon, 27 Apr 2026 11:36:56 -0700
Subject: [PATCH] Adjust ordering and add optional statement

---
 self-host/advanced/wild-card-domains.mdx | 41 +++++++++++++-----------
 1 file changed, 22 insertions(+), 19 deletions(-)

diff --git a/self-host/advanced/wild-card-domains.mdx b/self-host/advanced/wild-card-domains.mdx
index e2cd30d..2c082ba 100644
--- a/self-host/advanced/wild-card-domains.mdx
+++ b/self-host/advanced/wild-card-domains.mdx
@@ -140,25 +140,7 @@ This is the default config generated by the installer. This is shown here for re
   ```
 </Step>
 
-<Step title="2. Add Wildcard Domains">
-  Add the domain and wildcard domain to the domains section of the next (front end) router in the dynamic config. This tells Traefik to generate a wildcard certificate for the base domain and all subdomains.
-
-  ```yaml title="dynamic_config.yml" highlight={8-12}
-  next-router:
-    rule: "Host(`pangolin.example.com`) && !PathPrefix(`/api/v1`)"
-    service: next-service
-    entryPoints:
-      - websecure
-    tls:
-      certResolver: letsencrypt
-      domains:
-        - main: "example.com"
-          sans:
-            - "*.example.com"
-  ```
-</Step>
-
-<Step title="3. Add Environment Variables">
+<Step title="2. Add Environment Variables">
   Add the environment variables for your DNS provider to the Traefik service in the docker compose file. This allows Traefik to authenticate with your DNS provider to create the DNS records needed for the challenge.
 
   ```yaml title="docker-compose.yml" highlight={11-13}
@@ -180,6 +162,27 @@ This is the default config generated by the installer. This is shown here for re
       - ./config/letsencrypt:/letsencrypt
   ```
 </Step>
+
+<Step title="3. Add Wildcard Domains">
+
+  This step is optional and only effects the certs generated for the Pangolin dashboard. If you only plan to create wildcard resources and not use the dashboard, you can skip this step. 
+
+  Add the domain and wildcard domain to the domains section of the next (front end) router in the dynamic config. This tells Traefik to generate a wildcard certificate for the base domain and all subdomains.
+
+  ```yaml title="dynamic_config.yml" highlight={8-12}
+  next-router:
+    rule: "Host(`pangolin.example.com`) && !PathPrefix(`/api/v1`)"
+    service: next-service
+    entryPoints:
+      - websecure
+    tls:
+      certResolver: letsencrypt
+      domains:
+        - main: "example.com"
+          sans:
+            - "*.example.com"
+  ```
+</Step>
 </Steps>
 
 <Warning>