Hi Mike,
I certainly think ColdBox is well suited from what you described.
Check out the multi domain interceptor on ColdBox Forgebox. It should be what you need to handle the sub domains. And yes Modules would be a great for for new ‘apps’ that get added over time as they can be loaded and unloaded based on additional criteria like permissions. I would also check out the Security interceptor as well as Dan Vega’s solitary module since security will most likely come into play.
Nolan Dubeau
Load .,8,1