[Bug]: Can't connect via CloudFlare tunnel

[DavidTs93]

What happened?

Created a tunnel to my host with AudiobookShelf on it via Docker, added the port under the tunnel's "Public Hostname", but it fails to load (error 502 after a while).
I tried (ChatGPT suggested) to use network_mode: "host" in the compose file instead of the port publishing, and now it worked on port 80.
Why is it only working in network_mode: "host" mode?

What did you expect to happen?

To connect via the port, and not only when using the host's network (network_mode: "host").

Steps to reproduce the issue

1. Run AudiobookShelf on Docker (no special settings) and publish the necessary port (80)
2. Add it to Cloudflare's tunnel
3. Won't work

Audiobookshelf version

2.19.5

How are you running audiobookshelf?

Docker

What OS is your Audiobookshelf server hosted from?

Linux

If the issue is being seen in the UI, what browsers are you seeing the problem on?

None

Logs

Additional Notes

No response

[DavidTs93]

Just checked the logs: when connecting locally it writes [SocketAuthority] Socket Connected to /audiobookshelf/socket.io ..., but when accessing via the tunnel nothing shows up, so I'm assuming it doesn't even reach it. But why? (yes, I have the correct mapped port...)

[nichwall]

This is specific to the Cloudflare configuration and is not a bug with ABS.

[Vito0912]

This sounds like a problem with your configuration/Docker not ABS

[DavidTs93]

Is it? Jellyfin works just fine... No difference between their configs.

[Vito0912]

Is it? Jellyfin works just fine... No difference between their configs.

If it works in host mode but not with your configuration, it's very likely a problem with your configuration. Host mode more or less bypasses Docker's routing.

I also don't have any clue how ABS should make a distinction. It serves everything that comes to that port.

How does your config look like, so we can help you better?

[DavidTs93]

Ran audiobookshelf from compose (copy-paste from the site), only change is the published port was changed to 8097.
Ran cloudflared via Docker to connect the tunnel.
In CloudFlare's site, under the tunnel, added a Public Hostname named "abs.mydomain.com", using HTTP, and the IP is 10.0.0.4:8097 (the host has a static local IP).
If you prefer I share the compose file let me know please.

[Vito0912]

I've never used Cloudflare tunnels, but if 10.0.0.4 is the local IP of your server running Audiobookshelf, this should be fine.
You can try to ping it from your local network/from the cloudflare container to be sure. If you can't reach abs then something is wrong with your docker setup
Another way would be to put Cloudflare and Audiobookshelf in the same network.

[DavidTs93]

ABS compose file:
`services:
audiobookshelf:
image: advplyr/audiobookshelf:2.19.5
container_name: audiobookshelf
environment:
- PUID=${PUID}
- PGID=${PGID}
- TZ=${TZ}
volumes:
- ${PREFS}/audiobookshelf/config:/config
- ${PREFS}/audiobookshelf/metadata:/metadata
- ${MEDIA}/audiobooks:/audiobooks
- ${MEDIA}/podcasts:/podcasts
ports:
- 8097:80
restart: unless-stopped
networks:
- my_home

networks:
my_home:
external: true`

Cloudflare setting for ABS:
Subdomain: abs
Domain: mydomain.com
Type: HTTP
URL: 10.0.0.4:8097

Jellyfin compose file:
`services:
jellyfin:
image: jellyfin/jellyfin:10.10.6
container_name: jellyfin
environment:
- PUID=${PUID}
- PGID=${PGID}
- TZ=${TZ}
- NVIDIA_VISIBLE_DEVICES=all
volumes:
- ${PREFS}/jellyfin/config:/config
- ${PREFS}/jellyfin/cache:/cache
- ${MEDIA}:/media
ports:
- 8096:8096
restart: unless-stopped
deploy:
resources:
reservations:
devices:
- driver: nvidia
count: 1
capabilities: [gpu]
networks:
- my_home

networks:
my_home:
external: true`

Cloudflare setting for Jellyfin:
Subdomain: jellyfin
Domain: mydomain.com
Type: HTTP
URL: 10.0.0.4:8096

I ran multiple ping tests, restarted all 3 containers (with compose's down, then up -d), changed the ports - everything stayed the same: Jellyfin works, ABS doesn't. Except for when I used network_mode: "host" - then ABS worked.

[nichwall]

ABS compose file:
`services:
audiobookshelf:
image: advplyr/audiobookshelf:2.19.5
container_name: audiobookshelf
environment:
- PUID=${PUID}
- PGID=${PGID}
- TZ=${TZ}
volumes:
- ${PREFS}/audiobookshelf/config:/config
- ${PREFS}/audiobookshelf/metadata:/metadata
- ${MEDIA}/audiobooks:/audiobooks
- ${MEDIA}/podcasts:/podcasts
ports:
- 8097:80
restart: unless-stopped
networks:
- my_home

networks:
my_home:
external: true`

ABS uses port 13378, not 8097. You will need to use the PORT environment variable to change that. ABS also does not use GUID or PUID.

https://www.audiobookshelf.org/docs#env-configuration

Edit to correct: you are using port 80 internally correctly, I mixed up internal and external ports.

[Vito0912]

Because you already use same networks, you should use the right hand, internal port, not the external port afaik. Try audiobookshelf:80

@nichwall ABS-Docker uses 80, doesn't it?

[nichwall]

@nichwall ABS-Docker uses 80, doesn't it?

Thanks, yes. I mixed up internal and external ports, fixed my comment

[DavidTs93]

Because you already use same networks, you should use the right hand, internal port, not the external port afaik. Try audiobookshelf:80

@nichwall ABS-Docker uses 80, doesn't it?

Well, audiobookshelf:80 worked 😐.
First: thanks!!!!
Second: how come the IP:port didn't work?

[Vito0912]

There are multiple factors connected through it. The best thing is to understand how Docker and Docker networking works. It's very understandable via the docs. (Just a tip: While it might be easy to have it explained by an AI, AI often mixes things up and explains it wrong or only partially right. Docker has very good docs.)

IP:80 should also work if it does for Jellyfin. But there is a big difference between internal and external ports. Left is external, right is internal. If a container is part of a network, then it accesses it through internal ports. Your IP probably is also only the internal IP of your server and not the internal IP of your home network. If it were, then IP:8097 would have worked. Host mode is like being binded directly to the host. So the internal port is now listened at the host machiene

If your issue is resolved now, can you close the issue :)? If you have more questions about Docker you can also ask me on Discord. Messages will only spam Nichwall too

[DavidTs93]

All good, thanks for the help!