My problem: when I change in cloudflare "my ip : port" in "sb-module: port" I get a bad gatewaye and page does not open. I the help pages it is discribed but not working for me "Add a public hostname. Still on the tunnel's page, open Hostname routes → Add (older screens call it Public Hostname): pick a subdomain (say jellyfin), your domain, and set the service to HTTP → sb-jellyfin:8096. The tunnel joins SparkBox's internal network, so every app is reachable by its container name — sb-jellyfin:8096, sb-audiobookshelf:13378, sb-npm:80, and so on."
7 replies
Chris wrote:
Cloudflare Tunnel’s guide used an app address that doesn’t work for many SparkBox boxes, which can cause the Bad Gateway you’re seeing; the corrected guide uses the right internal app names and ports. Which app are you publishing, and what exact Service address did you enter? I’ll give you the matching address. You can leave the existing IP-and-port route in place for now.
franciscus wrote:
In cloudflare entry: sb-tomsparkcal:4318 to calendar.mydomain.de gives error 1033
Chris wrote:
Thanks—that target uses the right container name and inside port for TomSparkCal. Set the Cloudflare service type to HTTP and the service URL to http://sb-tomsparkcal:4318; the generic examples in our guide did not include this app, and we corrected the guide in SparkBox 1.6.793. Could you check whether the Cloudflare Tunnel card in SparkBox currently shows healthy or unhealthy? That will tell us whether the connector is available before we look further at the route.
franciscus wrote:
I cannot check this at the moment. I did this not only with sb-tomsparkcal:4318 but several other apps nothing worked. When I change "sb-tomsparkcal" with my ipaddress it works. On the sparkbox, Tom AI giving the heads up that calendar was reachable from the outside. With cloudflare all the apps I listed there are reacheble from outside my home!!! So I asked how to change this. He came up with the help page I discibed in the last post, and I did it exactly the way the help pages described it. So I am a bit confused
Chris wrote:
I'm sorry—I told you that the container address was correct without verifying it. SparkBox's general Cloudflare examples had addresses that don't work for every app; version 1.6.793 corrected the guide, but updating SparkBox does not change routes already configured in Cloudflare. A public hostname is reachable from the internet by design unless you separately restrict it, and switching from an IP target to a container-name target does not make it private. If you did not intend those apps to be public, remove their public-hostname routes in Cloudflare while you decide which ones should be exposed. When you're back at the box, please send your SparkBox version and, for one failing route, its Service type and target host:port only (not your public hostname or IP); don't change that route yet. I've corrected what I know about this so the unverified claim that the target was right isn't repeated.
franciscus wrote:
What I understood from Tom and the note on my homepage, that if I put sb-tomsparkcal instead of my ipaddress I can access it from outside it is more secure. My job I need the access outside my homenetwork.
Chris wrote:
I can see why the homepage note sounded like the container name would make this safer, but it only changes how Cloudflare finds the app; it does not restrict who can reach it. A Cloudflare public-hostname route is meant to make that hostname reachable from outside your home, whether its target is an IP address or an sb- name. If you want to keep a route available externally, please check whether it requires an authenticated Cloudflare Access sign-in before showing the app. If it does not, and you do not want the app public, disable that public-hostname route for now. The note is about routing, not a security control.