Cloudflare Tunnel guide

When to use it

Cloudflare Tunnel publishes PlexSub without opening inbound ports directly to your server. It exposes your public HTTPS domain to the local Docker application.

Expected PlexSub configuration

Variable	Recommended value
APP_BASE_URL	Final public HTTPS URL.
TRUST_PROXY_LEVEL	1 when Cloudflare Tunnel is the trusted proxy in front of PlexSub.
FORCE_SECURE_COOKIES	1.

Do not enable PLEXSUB_ALLOW_PRIVATE_TARGETS merely because you use Cloudflare Tunnel; it has a different purpose and affects internal-target security.

General flow

1. Configure a domain in Cloudflare.
2. Create a tunnel to the Docker server.
3. Point the public hostname to http://localhost:5000 or the locally published Compose port.
4. Set APP_BASE_URL to the public URL.
5. Restart the app.
6. Test sign-in in a private window.

Public demo

The demo compose binds by default to:

127.0.0.1:${DEMO_PORT:-5001}:5000

This works well with Cloudflare Tunnel: the demo is reachable locally by the tunnel but is not published across every host interface.

Common issues

Symptom	Likely cause	Resolution
Login does not persist	Incorrect cookie/proxy settings	Check APP_BASE_URL, TRUST_PROXY_LEVEL, and HTTPS.
Unexpected redirects	Public URL does not match	Correct APP_BASE_URL.
Error 502	Tunnel cannot reach local port	Check the published port and container status.
Works locally but not externally	Incomplete DNS/tunnel setup	Check the hostname in Cloudflare.