Unable to run Beszel Hub behind Cloudflare Tunnel – Agent WebSocket fails with 401

[ron159]

Hi, I’m trying to expose my Beszel Hub instance through Cloudflare Tunnel, but the Agent cannot connect when using the Tunnel domain.

When accessing the Hub via the Cloudflare Tunnel domain, the Agent reports:
WARN WebSocket connection failed err="unexpected status code: 401"
Local access (http://localhost:8090) works normally.
Only when switching APP_URL to the Cloudflare Tunnel domain does authentication fail.

Environment:

Beszel version: 0.18.6
Deployment: Docker Compose

What I tried:

Setting APP_URL to the Tunnel domain (https://xxx.cloudflareTunnel.com)

Ensuring Cloudflare proxy is enabled

No Access / Zero Trust policies enabled

No caching / minify / Rocket Loader

Tunnel ingress config points to http://127.0.0.1:8090

Expected behavior:
Agent should authenticate and connect normally through the Cloudflare Tunnel domain.

Actual behavior:
Agent fails WebSocket handshake with 401.

Would appreciate guidance on how to correctly run Beszel behind Cloudflare Tunnel.

Thanks!

[svenvg93]

I use it with CF Tunnels as well without any problem or special configuration.
401 means the hub is rejecting the agent as unauthorized. Do you have the correct HUB_URL, TOKEN and KEY set on the agent?
APP_URL is for the hub itself to supply the correct URL in notifications etc.

[FungY911]

+1

[txrscl]

I thought this was just me, I have the same issue, I even can set it up and access it though a local dns using pi-hole, but it wont go through my CF tunnel. I have numerous other services working the CF tunnel, but cant get Beszel to work for the life of me.