Sgine

I'm not using Tautulli so I do not know what kind of check it does, but if you are connecting through HTTPS it should be a secure connection. I think you can ignore it if you can see that only through Tautulli

Hey @SkarmOry, thanks a lot for pointing that out and sorry for the late reply! 😅 You are absolutely right about the Cloudflare Tunnel part, I wrote it wrong in the guide. The correct setup is exactly as you described, so I’ll fix that to avoid any confusion. Regarding the “Custom server access URLs” in Plex: in my setup it worked even without :443, but you’re right, adding it is definitely the better approach to make sure all clients connect properly. I’ll update the guide with that!

The goal is to enable Plex to operate at full bandwidth even from Apps without relying on Plex Relay (capped at maximum 2mbps), ensuring secure and efficient access to your media server without opening ports in your router. Plex Relay is used by default because, even with a subdomain configured for browser access at full bandwidth, apps could not utilize the subdomain effectively. This guide provides a step-by-step walkthrough for setting up SWAG (Secure Web Application Gateway) with Plex on Unraid. Hoping to do something helpful because i haven’t found a guide on that, and I struggled a bit in configuring it, so I've written all the steps here. I assume that Plex and the Cloudflare tunnel are already configured and working. Plex on Unraid with Cloudflare and SWAG 1. Install SWAG Why: SWAG serves as a reverse proxy that secures your applications (like Plex) with HTTPS and handles incoming traffic smartly. Install SWAG from the Unraid Community Applications plugin. Configure the container with the following: Network Mode: Bridge (for flexibility and isolation). Ports: Map the container’s port 443 to a host port (e.g., 444). Environment Variables: URL: Your root domain (e.g., yourDomain.com). SUBDOMAINS: Add the subdomain for Plex (e.g., plex). VALIDATION: Use dns for DNS validation with Let's Encrypt. DNSPLUGIN: Set to cloudflare for Cloudflare integration. EMAIL: Your email for certificate notifications. Volumes: Map /mnt/user/appdata/swag on your host to /config in the container for configuration files. 2. Set Up DNS Validation for Certificates Why: Let’s Encrypt certificates ensure HTTPS security for your domain. DNS validation is automated with Cloudflare. Obtain a Cloudflare API token with the "Edit Zone DNS" template. Save the token in /config/dns-conf/cloudflare.ini as: dns_cloudflare_api_token = YOUR_API_TOKEN Restrict its file permissions using: chmod 600 /mnt/user/appdata/swag/dns-conf/cloudflare.ini SWAG will now be able to generate and renew certificates automatically. 3. Configure SWAG’s Reverse Proxy for Plex Why: A reverse proxy routes plex.yourDomain.com traffic securely to your Plex container. Create a file named plex.subdomain.conf in /mnt/user/appdata/swag/nginx/proxy-confs/ with the following content: server { listen 443 ssl; listen [::]:443 ssl; server_name plex.yourDomain.com; include /config/nginx/ssl.conf; location / { proxy_pass http://yourInternalIP:32400; # Use your Plex IP and port proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; } } Replace yourInternalIP with your Unraid server's IP. This file ensures incoming requests are forwarded to Plex, with proper HTTPS headers. 4. Configure Cloudflare Tunnel Why: Cloudflare Tunnel hides your server’s IP while securely forwarding traffic to SWAG. From the Cloudflare Tunnel interface, set up an HTTPS service pointing to yourInternalIP:444 . Configure the Origin Server Name and HTTP Host Header to plex.yourdomain.com . Alternatively, create a Cloudflare Tunnel with the following ingress rule: ingress: \- hostname: plex.yourDomain.com service: https://yourInternalIP:444 \- service: http_status:404 Make sure the URL uses https:// and corresponds to the host port assigned to SWAG (e.g., 444). 5. Verify and Test Connectivity Why: Ensures SWAG and Cloudflare are properly configured. Access Plex locally to confirm it’s running: http://yourInternalIP:32400 Test the reverse proxy: From an external network, visit: https://plex.yourDomain.com . If successful, Plex should be accessible securely. 6. Troubleshoot Issues If SWAG doesn’t seem to forward traffic properly: Check file names: SWAG only includes .subdomain.conf files from the proxy-confs directory. Reload SWAG after changes: Restart the container to reapply configurations. Use nginx -T to confirm your custom configuration is loaded. A 502 Bad Gateway error usually indicates a misconfigured proxy_pass directive or mismatched Host header. Ensure Cloudflare sends the correct SNI (plex.yourDomain.com) and HTTP Host Header. 7. Finalizing Plex Settings Why: Tells Plex to advertise the correct public access URL to clients. In Plex, go to Settings > Network > Custom server access URLs and set your Custom Server Access URL to: https://plex.yourDomain.com:443 Flow of Traffic External Client: Requests https://plex.yourDomain.com . Cloudflare Tunnel: Forwards the request to SWAG via https://yourInternalIP:444 . SWAG: Matches the domain to plex.subdomain.conf and proxies the request to Plex on http://yourInternalIP:32400 . Plex: Serves the content to the client. This setup ensures that your Plex instance is securely accessible over HTTPS with minimal exposure to the internet, thanks to the combination of Cloudflare Tunnel, SWAG, and DNS-based certificate validation. So now you can disable Plex Relay and access Plex at full bandwidth both from applications, your subdomain or local connection (if you are at home or via VPN). Hope everything is clear!