APPLICATION_HOSTS not working for Cloudflare tunnel

[Telmo]

OS & Hardware

Running dawarich in docker container:

Client: Docker Engine - Community
 Version:           28.4.0
 API version:       1.51
 Go version:        go1.24.7
 Git commit:        d8eb465
 Built:             Wed Sep  3 20:57:13 2025
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          28.4.0
  API version:      1.51 (minimum version 1.24)
  Go version:       go1.24.7
  Git commit:       249d679
  Built:            Wed Sep  3 20:57:13 2025
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.7.27
  GitCommit:        05044ec0a9a75232cad458027ca83437aae3f4da
 runc:
  Version:          1.2.5
  GitCommit:        v1.2.5-0-g59923ef
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

Version
Running https://github.com/Freika/dawarich/releases/tag/1.0.0

Describe the bug
This issue is similar to #79 and #1534 . After following the guide (https://dawarich.app/docs/tutorials/expose-instance-via-cloudflare-tunnel/) when trying to upload points from the iOS App I get an Upload Failed - tap for details the error is Upload Error: Server returned invalid response code 403

Dawarich app shows the following line in the logs:

[ActionDispatch::HostAuthorization::DefaultResponseApp] Blocked hosts:

I've double checked the env variable:

APPLICATION_HOSTS="localhost,::1,dawarich.<cloudflare.tld>,'',192.168.1.105"
RAILS_APPLICATION_CONFIG_HOSTS="dawarich<cloudflare.tld>,'',192.168.1.105"

I've verified that the env variable is being read by removing the host IP 192.168.1.105 at which point the error is:

dawarich-app      | [ActionDispatch::HostAuthorization::DefaultResponseApp] Blocked hosts:
dawarich-app      | [ActionDispatch::HostAuthorization::DefaultResponseApp] Blocked hosts: 192.168.1.105:3000

Expected behavior
Uploading point from the iOS app to self hosted dawarich instance behind a cloudflare tunnel should work

Additional context

I can login just fine in my local network.

I believe that the error maybe related to the tunnel container not having an IP when talking to dawarich_app I believe that the '' in APPLICATION_HOSTS is supposed to cover that use case but it is not working as expected.

There is no reverse proxy involve, the tunnel is talking directly to the application

this is the docker-compose file:

networks:
  dawarich:

services:
  dawarich-redis:
    image: redis:7.4-alpine
    container_name: dawarich-redis
    command: redis-server
    networks:
      - dawarich
    volumes:
      - /Configs/dawarich/redis/data:/data
    restart: always
    healthcheck:
      test: [ "CMD", "redis-cli", "--raw", "incr", "ping" ]
      interval: 10s
      retries: 5
      start_period: 30s
      timeout: 10s
  dawarich-db:
    image: postgis/postgis:17-3.5-alpine
    shm_size: 1G
    container_name: dawarich-db
    volumes:
      - /Configs/dawarich/db/data:/var/lib/postgresql/data
    networks:
      - dawarich
    env_file: .env
    restart: always
    healthcheck:
      test: [ "CMD", "pg_isready", "-U", "postgres" ]
      interval: 10s
      retries: 5
      start_period: 30s
      timeout: 10s
  dawarich-app:
    image: freikin/dawarich:latest
    container_name: dawarich-app
    volumes:
      - /Configs/dawarich/public:/var/app/public
      - /Configs/dawarich/watched:/var/app/tmp/imports/watched
      - /Configs/dawarich/storage:/var/app/storage
      - /Configs/dawarich/db/data:/dawarich_db_data
    networks:
      - dawarich
    ports:
      - 3000:3000
      # - 9394:9394 # Prometheus exporter, uncomment if needed
    stdin_open: true
    tty: true
    entrypoint: web-entrypoint.sh
    command: ['bin/rails', 'server', '-p', '3000', '-b', '::']
    restart: on-failure
    env_file: .env
    logging:
      driver: "json-file"
      options:
        max-size: "100m"
        max-file: "5"
    healthcheck:
      test: [ "CMD-SHELL", "wget -qO - http://127.0.0.1:3000/api/v1/health | grep -q '\"status\"\\s*:\\s*\"ok\"'" ]
      interval: 10s
      retries: 30
      start_period: 30s
      timeout: 10s
    depends_on:
      dawarich-db:
        condition: service_healthy
        restart: true
      dawarich-redis:
        condition: service_healthy
        restart: true
    deploy:
      resources:
        limits:
          cpus: '0.50'    # Limit CPU usage to 50% of one core
          memory: '4G'    # Limit memory usage to 2GB

  dawarich-sidekiq:
    image: freikin/dawarich:latest
    container_name: dawarich-sidekiq
    volumes:
      - /Configs/dawarich/public:/var/app/public
      - /Configs/dawarich/watched:/var/app/tmp/imports/watched
      - /Configs/dawarich/storage:/var/app/storage
    networks:
      - dawarich
    stdin_open: true
    tty: true
    entrypoint: sidekiq-entrypoint.sh
    command: ['bundle', 'exec', 'sidekiq']
    restart: on-failure
    env_file: .env
    logging:
      driver: "json-file"
      options:
        max-size: "100m"
        max-file: "5"
    healthcheck:
      test: [ "CMD-SHELL", "pgrep -f sidekiq" ]
      interval: 10s
      retries: 30
      start_period: 30s
      timeout: 10s
    depends_on:
      dawarich-db:
        condition: service_healthy
        restart: true
      dawarich-redis:
        condition: service_healthy
        restart: true
      dawarich-app:
        condition: service_healthy
        restart: true

  tunnel:
   image: cloudflare/cloudflared:latest
   command: tunnel --no-autoupdate run
   networks:
    - dawarich
   env_file: .env
   restart: always
   container_name: tunnel
   depends_on:
    - dawarich-app

and the redacted .env

TUNNEL_TOKEN=*****
POSTGRES_USER=random
POSTGRES_PASSWORD=*****
POSTGRES_DB=dawarich_production
RAILS_ENV=production
REDIS_URL=redis://dawarich-redis:6379
DATABASE_HOST=dawarich-db
DATABASE_PORT=5432
DATABASE_USERNAME=random
DATABASE_PASSWORD==*****
DATABASE_NAME=dawarich_production
MIN_MINUTES_SPENT_IN_CITY=60
TIME_ZONE=America/New_York
APPLICATION_PROTOCOL=http
PROMETHEUS_EXPORTER_ENABLED=false
PROMETHEUS_EXPORTER_HOST=0.0.0.0
PROMETHEUS_EXPORTER_PORT=9394
SECRET_KEY_BASE==*****
RAILS_LOG_TO_STDOUT="true"
STORE_GEODATA="true"
SELF_HOSTED="true"
APPLICATION_HOSTS="localhost,::1,dawarich.CLOUDFLARE.TLD,''"
RAILS_APPLICATION_CONFIG_HOSTS="dawarich.CLOUDFLARE.TLD,''"

[ChoosenMEME]

For me adding the "additional application settings" from the instructions breaks the tunnel.

content_type text/css text/plain text/xml text/x-component text/javascript application/x-javascript application/javascript application/json application/manifest+json application/vnd.api+json application/xml application/xhtml+xml application/rss+xml application/atom+xml application/vnd.ms-fontobject application/x-font-ttf application/x-font-opentype application/x-font-truetype image/svg+xml image/x-icon image/vnd.microsoft.icon font/ttf font/eot font/otf font/opentype

But no clue, what part of that breaks it all, so for now i just removed it all, and no problems so far (added that part less than a week ago was also working perfectly fine without it for months prior) so not needed i guess.

Now that i removed it, everything is reachable again.