diff --git a/ansible/group_vars/all.yml b/ansible/group_vars/all.yml
index b732479..ec3c2f9 100644
--- a/ansible/group_vars/all.yml
+++ b/ansible/group_vars/all.yml
@@ -1,5 +1,5 @@
 ---
-ansible_user: "ansible"
+ansible_user: "root"
 
 sysadmin_user: "alessandrovitali"
 sysadmin_public_ssh_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAm/J+9YG+odym9In9C4iLcrfXlrlPK2TygtI7lBNNpl"
diff --git a/ansible/playbook.yml b/ansible/playbook.yml
index f6e0646..f7d7f82 100644
--- a/ansible/playbook.yml
+++ b/ansible/playbook.yml
@@ -6,3 +6,4 @@
     - role: studio.ansible.base
     - role: studio.ansible.users
     - role: studio.ansible.security
+    - role: dokploy
diff --git a/ansible/roles/dokploy/defaults/main.yml b/ansible/roles/dokploy/defaults/main.yml
new file mode 100644
index 0000000..cd622d8
--- /dev/null
+++ b/ansible/roles/dokploy/defaults/main.yml
@@ -0,0 +1,14 @@
+---
+# Official Dokploy installer
+dokploy_installer_url: "https://dokploy.com/install.sh"
+dokploy_installer_path: "/usr/local/bin/dokploy-install.sh"
+
+# Pin to a specific release tag for reproducible installs
+dokploy_version: "latest"
+
+# Packages the installer expects on a minimal Debian image
+# dokploy_prerequisites:
+#   - ca-certificates
+#   - curl
+#   - openssl
+#   - iproute2
diff --git a/ansible/roles/dokploy/tasks/main.yml b/ansible/roles/dokploy/tasks/main.yml
new file mode 100644
index 0000000..36a39ae
--- /dev/null
+++ b/ansible/roles/dokploy/tasks/main.yml
@@ -0,0 +1,33 @@
+---
+# - name: Install Dokploy prerequisites
+#   ansible.builtin.apt:
+#     name: "{{ dokploy_prerequisites }}"
+#     state: present
+#     update_cache: true
+
+- name: Download Dokploy installer
+  ansible.builtin.get_url:
+    url: "{{ dokploy_installer_url }}"
+    dest: "{{ dokploy_installer_path }}"
+    mode: "0755"
+
+# The upstream installer is not idempotent & exits non-zero if the swarm is already initialized. Guard on the presence of the dokploy swarm service
+- name: Check if Dokploy is already installed
+  ansible.builtin.command: docker service inspect dokploy
+  register: dokploy_installed
+  changed_when: false
+  failed_when: false
+
+- name: Install Dokploy
+  ansible.builtin.command: "{{ dokploy_installer_path }}"
+  environment:
+    DOKPLOY_VERSION: "{{ dokploy_version }}"
+  changed_when: true
+  when: dokploy_installed.rc != 0
+
+# - name: Update Dokploy (opt-in)
+#   ansible.builtin.command: "{{ dokploy_installer_path }} update"
+#   environment:
+#     DOKPLOY_VERSION: "{{ dokploy_version }}"
+#   changed_when: true
+#   when: dokploy_installed.rc == 0
diff --git a/terraform/main.tf b/terraform/main.tf
index 7fcc66e..717660d 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -58,9 +58,18 @@ locals {
 }
 
 # Publish the VPS IP as a Cloudflare A record
-resource "cloudflare_dns_record" "a" {
+resource "cloudflare_dns_record" "domain" {
   zone_id = data.cloudflare_zone.zone.id
-  name    = var.record_name
+  name    = "@"
+  type    = "A"
+  content = local.public_ip
+  proxied = var.cloudflare_proxied
+  ttl     = var.cloudflare_proxied ? 1 : 3600
+}
+
+resource "cloudflare_dns_record" "subdomain" {
+  zone_id = data.cloudflare_zone.zone.id
+  name    = "*"
   type    = "A"
   content = local.public_ip
   proxied = var.cloudflare_proxied
diff --git a/terraform/terraform.tfvars b/terraform/terraform.tfvars
index 5c81a5d..660a6ba 100644
--- a/terraform/terraform.tfvars
+++ b/terraform/terraform.tfvars
@@ -4,7 +4,6 @@ hcloud_server_type  = "cx23"
 hcloud_image        = "debian-13"
 hcloud_location     = "nbg1"
 
-record_name          = "dokploy"
 cloudflare_proxied   = true
 
 # Note: Use file() to easily read your local SSH public key
diff --git a/terraform/variables.tf b/terraform/variables.tf
index 1cf5fa0..062b660 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -45,12 +45,6 @@ variable "domain_name" {
   description = "Cloudflare zone (apex domain) in which to create the A record"
 }
 
-variable "record_name" {
-  type        = string
-  description = "DNS record name relative to the zone; use \"@\" for the apex"
-  default     = "dokploy"
-}
-
 variable "cloudflare_proxied" {
   type        = bool
   description = "Whether Cloudflare should proxy (orange-cloud) the A record"