u/ZealousidealSir1737

Hi All,

I have an issue with connecting to my Jellyfin server with Cloudflare and Nginx running as docker containers.

I can see that the request is arriving in Nginx but the connection is being refused by Jellyfin.

I can curl to Jellyfin from the CLI using the docker bridge IP address and via browser the NAS host IP and port 8096

The details are below.

Any idea? What am I doing wrong?

Thanks in advance,
Chris

This is the error I get:

2026/07/05 02:31:31 [error] 22#22: *7 connect() failed (111: Connection refused) while connecting to upstream, client: 103.175.213.206, server: media.disgruntleddog.cc, request: "GET / HTTP/1.1", upstream: "http://172.29.0.2:8086/", host: "media.mydomain.cc"
103.175.213.206 - - [05/Jul/2026:02:31:31 +0000] "GET / HTTP/1.1" 502 559 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36"

The docker-compose is this:

services:
  # Cloudflare Tunnel Client
  cloudflare-tunnel:
    image: cloudflare/cloudflared:latest
    container_name: cloudflare-tunnel
    restart: unless-stopped
    command: tunnel --no-autoupdate run
    environment:
      - TUNNEL_TOKEN=myToken
    networks:
      - proxy-net
  # Nginx Reverse Proxy
  nginx-proxy:
    image: nginx:alpine
    container_name: nginx-proxy
    restart: unless-stopped
#    ports:
#      - "80:80" # Optional: strictly for local network access
    volumes:
        - /share/Docker/externalaccess/nginx.conf:/etc/nginx/nginx.conf:ro   
    networks:
      - proxy-net
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:latest
    container_name: jellyfin
    environment:
      - PUID=1002
      - PGID=100
      - TZ=Asia/Makassar
    volumes:
      - /share/Docker/jellyfin/config:/config
      - /share/Media/TV:/data/tvshows
      - /share/Media/Movies:/data/movies
    devices:
      - /dev/dri:/dev/dri # Enables hardware transcoding (adjust based on your GPU)
    ports:
      - 8096:8096
    networks:
      - proxy-net
    restart: unless-stopped

networks:
  proxy-net:
    driver: bridge

And my nginx.conf is this:

events { worker_connections 1024; }

http {
    # Optimize for Cloudflare proxy headers
    set_real_ip_from 0.0.0.0/0; # Trust the tunnel interface
    real_ip_header X-Forwarded-For;

    # Global proxy settings
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # Service Routing Configuration
    server {
        listen 80;
        server_name media.mydomain.cc; # Your public website hostname

        location / {
            # Route traffic internally using the container name
            proxy_pass http://jellyfin:8086; 
        }
    }
}

The network.xml for Jellyfin is this:

<?xml version="1.0" encoding="utf-8"?>
<NetworkConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <BaseUrl />
  <EnableHttps>false</EnableHttps>
  <RequireHttps>false</RequireHttps>
  <InternalHttpPort>8096</InternalHttpPort>
  <InternalHttpsPort>8919</InternalHttpsPort>
  <PublicHttpPort>8096</PublicHttpPort>
  <PublicHttpsPort>8920</PublicHttpsPort>
  <AutoDiscovery>true</AutoDiscovery>
  <EnableIPv4>true</EnableIPv4>
  <EnableIPv6>false</EnableIPv6>
  <EnableRemoteAccess>true</EnableRemoteAccess>
  <LocalNetworkSubnets />
  <LocalNetworkAddresses />
  <KnownProxies>
    <string>172.29.0.0/24</string>
  </KnownProxies>
  <IgnoreVirtualInterfaces>true</IgnoreVirtualInterfaces>
  <VirtualInterfaceNames>
    <string>veth</string>
  </VirtualInterfaceNames>
  <EnablePublishedServerUriByRequest>false</EnablePublishedServerUriByRequest>
  <PublishedServerUriBySubnet />
  <RemoteIPFilter />
  <IsRemoteIPFilterBlacklist>false</IsRemoteIPFilterBlacklist>
</NetworkConfiguration>

I put the known proxies values in.