Search the Community

Cloudflare and emby Config Version 1.0.0 Last Update 02-25-2022 Update by Pir8Radio ** UPDATE: I AM HEARING OF EMBY USERS GETTING VIDEO FILES BLOCKED WHEN USING CLOUDFLARE (FREE TIER). IF THIS IS THE CASE, I NO LONGER RECOMMEND USING CLOUDFLARE. Even with the cache bypass rules, your video still passes through their system and is technically against their TOS. Use CloudFlare at your own risk if you choose to continue. I'll update if I get more info. Please post in this thread if you find you have video loading/playing/downloading issues while using cloudflare or have received an email from them about this. MESSAGE FROM CLOUDFLARE: Free, Pro, and Business Plans serving videos or a disproportionate amount of non-HTML content can be in violation of Section 2.8 of the Self-Serve Subscription Agreement (TOS). This will turn into a full Cloudflare how-to. Others are welcome to edit this or PM me with suggestions.. However right now I'm just going to post some recommended settings for people who already have Cloudflare setup. There are a few cloudflare settings that break emby, some break it in obvious ways, some only certain apps in certain situations.. These are the settings I found that work well as of today. I'll try to maintain this post and update the header info should new features come out, or the community discovers better settings than these. As of today, these are the settings available to us in Cloudflare FREE account: First disable the two main things that will break emby, go to the "Speed" tab then "Optimization" sub-tab. DISABLE Auto Minify and Rocket Loader! (screen shots are in the recommended state) Other options on this settings page are optional to enable, I suggest enabling Brotli compression. It's a good thing. Now head over to the "Caching" tab and select the "Configuration" sub-tab. Set your Caching settings as shown below. THIS IS OPTIONAL: Other settings in this settings tab are optional to whatever you like.. I have "Always Online" enabled, its kind of a neat feature that caches as much of your emby server as it can in case your server is down, users will at least see an emby splash screen, that's usually about it.. but its something... kind of useless otherwise.. Handy if you have other websites, it will totally cache normal html websites and users can continue to use your cached site when you have a web server outage. Next head over to the "Rules" tab. Create these two rules: Rule #2 here we will bypass caching 99% of all video. Caching the video will actually slow down the client experience. It screws with the chunks and often times has to fully cache 1 chunk before cloudflare sends it to the client, causing playback delays. Rule #3 here will cache all images on the edge servers for 30 days. We need this rule, because cloudflare only caches known file urls, like picture.jpg or poster.png emby serves up webp images with NO EXTENSION so cloudflare doesn't know to cache these items. But 99% of emby images come from the /items/XXXXXX/images directory so we will just force cache everything that comes from this URL, it should be only images. Keep in mind when you enable this it can take some time to build up cache.. emby serves up different sized images based on browser screen size, apps, etc.. so if you load a page that is minimized to a small window on your desktop emby will serve smaller sized images, if you make your browser full screen, now emby will serve up larger images and those images may load slow the first few times until they get cached too. Go below this screenshot and I'll show you how to check if caching is working. Check to see if Cloudflare Caching is working Well, how do you know Cloudflare is doing its thang'? Use a browser like chrome, or the new Microsoft edge (which is just a rebranded chrome). Open the browser, right click in the browser window and go down to "Inspect" (there is an F key for this too I forget what it is, I should add that here lol). Once the dev window pops up adjust it so you have a good view on the right, click the "Network" tab, hit the reload button on whatever page you are on so some info populates on the right dev screen. You should see something similar to this: Right click on the table header (Name, Method, Status, Protocol) anywhere, just right click the "Name" one. Go down to "Response Headers" then "Manage Header Columns". A little window will pop up hit "Add custom header..." and then add this header: cf-cache-status Now select the little sub tab that says "all" now surf your way to your emby server, and you should see something like the below screenshot. Hit is well..... a hit! this image came from cloudflare and was never requested from your emby server, saving you from sending this image to the client, saving time and bandwidth. MISS is also kind of obvious, it was a miss, either due to never being cached yet (first time Cloudflare has seen this image or document) if you hit refresh a few times, cloudflare will then cache it and it will turn to HIT. BYPASS I'm actually not sure why my server is returning server 500 errors below, this image is being called for by emby clients but the server has no image to serve, but usually you should only see BYPASS on playing video's if your rules above are correct. Or in my case, a server error will not be cached. DYNAMIC this is also a NO HIT response.. this is usually due to Cloudflare knowing this resource changes a lot and doesn't want to cache it so your clients don't get served stale data, or its a video, websocket, or some other format Cloudfare's great automated intelligence deems it should not be cached. That is the basics that will save you a lot of headache and blaming emby for things not working.. There are lots of cool options to enable outside of these basic settings above, ask questions here, send ideas that maybe I have missed that work great for you.. I just wanted to throw this up due to a lot more of you guys using Cloudflare. In the end you should start to see more "HIT" responses... and a noticeably faster loading time for the clients, less bandwidth usage for your emby server, and everyone is happy.. Well..... within reason....

It took me a while to get Caddy v2 setup and working by itself. Then there were some struggles with getting it to work with Cloudflare. I thought I would share a guide to assist those who want to go that route. Prerequisites: Have your own domain Have the DNS of your domain setup with Cloudflare Have your Cloudflare API key/token "For this checkout my other article on setting up DNS updates via API" Have your Emby server set with a static internal IP Step 1: Download Caddy Visit https://caddyserver.com/download to download your binary. You will need to add a couple plugins for this to work. You will want to select 'caddy-dns/cloudflare' and 'kirsch33/realip' Review at the top that it shows "Extra features = 2' and select 'Download' Step 2: Download NSSM from https://nssm.cc/download "We will use this to run Caddy as a service" Step 3: Create folders for NSSM and Caddy on the root of the C:\ drive Step 4: Rename the caddy binary to just caddy.exe and put it in C:\Caddy\. Extract NSSM so you just have the nssm.exe and put that in your NSSM folder. Step 5: Create your caddyfile The caddyfile has no extension. You can open this with your favorite text editor. I use Notepad++. Below is the a sample caddyfile. The first email is the email address that you want to use to receive notifications if there are issues with the cert Adjust your domain to what you are using for Emby. Either 'domain.com', 'login.domain.com' or 'emby.domain.com' etc. The second email address is your email address for your Cloudflare account This also sets up logging for the reverse proxy which is really handy I choose to use the actual IP address of the server instead of localhost. Either will work. { email email@gmail.com } yourdomain.com { tls email@gmail.com { dns cloudflare 'Your Cloudflare API Key No Quotes' } log { output file C:\caddy\logs\emby_access.log { roll true # Rotate logs, enabled by default roll_size_mb 10 # Set max size X MB roll_gzip true # Whether to compress rolled files roll_local_time true # Use localhost time roll_keep 3 # Keep at most X log files roll_keep_days 7 # Keep log files for X days } } encode gzip reverse_proxy http://10.0.0.5:8096 { header_up X-Real-IP {remote_host} } } If you wanted to run any of the arr's as subsites to your main reverse proxy you can add the following to your caddyfile If you are running it on the same box instead of using the full domain name you would just use http://yourip:port You need to login to each of the arr applications and setup the base URL Login go to settings/general/base url Add the correct subsite. So for Radarr you would add /movies save and restart. { email email@gmail.com } yourdomain.com { tls email@gmail.com { dns cloudflare 'Your Cloudflare API Key No Quotes' } log { output file C:\caddy\logs\emby_access.log { roll true # Rotate logs, enabled by default roll_size_mb 10 # Set max size X MB roll_gzip true # Whether to compress rolled files roll_local_time true # Use localhost time roll_keep 3 # Keep at most X log files roll_keep_days 7 # Keep log files for X days } } encode gzip reverse_proxy http://10.0.0.5:8096 { header_up X-Real-IP {remote_host} } reverse_proxy /movies/* https://radarr.domain.com { header_up Host {upstream_hostport} header_up X-Forwarded-Host {host} } redir /movies /movies/ reverse_proxy /tv/* https://sonarr.domain.com { header_up Host {upstream_hostport} header_up X-Forwarded-Host {host} } redir /tv /tv/ reverse_proxy /music/* https://lidarr.domain.com { header_up Host {upstream_hostport} header_up X-Forwarded-Host {host} } redir /music /music/ reverse_proxy /audiobooks/* https://readarr.domain.com { header_up Host {upstream_hostport} header_up X-Forwarded-Host {host} } redir /audiobooks /audiobooks/ } Step 6: Create a user for caddy to run as and set password. You will need this password later down when we setup the service. I'm going to use srvcaddy. Step 7: Allow srvcaddy user to run as service You want to open up Local Security Policy Go to 'Local Policies/User Rights Assignment/Log on as a service' and add our new user srvcaddy Step 8: Add your domain under Emby network settings Login go to settings/network/external domain and add your domain name Step 9 : Launch cmd prompt as administrator Step 10: Install Caddy as a service We will need to type cd "C:\NSSM" in cmd prompt. Then you will need to type nssm install Caddy We will want to edit Log on to our service account Then select 'Install service' Now you can open up services and start caddy The first time this runs it will take a few minutes to generate your certificate on the computer. Step 11: Adjust firewall rules You now only want the local computer to talk on Emby's port 8096. All other devices you will want to have it connect via ports 80,443. Open up windows firewall Make sure all of Emby's rules are disabled Create a new rule Step 12: Create a port forward in your router/firewall from external port 443 to your server port 443. Do to the differences in every router/firewall you will need to refer to manual or Google on this step. For even more security you can lock down only Cloudflare's IP addresses to be able to route to your server. Since we are updating the cert via API you only need port 443 open to Cloudflare. No need for port 80 to be open external. Step 13: Create a DNS entry in your router/firewall for your server. Again do to to many differences you will need to consult your device's manual or google on how to accomplish this. You will want to create an internal record that takes your domain name for your Emby server and points it to the local IP. This way you can take advantage of local login with pin. Step 14: Set Cloudflare's SSL/TLS Encryption Login to Cloudflare, select your domain, and go to SSL/TLS You want to set this to Full/Strict That's it... you should now have a fully encrypted connection to your Emby server internal and external. You will now be connecting to your server via port 443 instead of 8096. Hope this helps anyone struggling with setting this up.

I have a Linux Emby server setup on my vps. I want my server to use cloudflare caching system so that it can be faster. What i want to know is, how to setup it? I have a domain and I've set that domain on cloudflare. Now what settings aree needed to be changes in the linux machine and what settings are needed to be changed on emby-server? I saw a emby-forum that suggested what all settings are needed to be done on cloudflare part. I just want to know how to connect Emby server to cloudflare.

I recently switched my domain provider to Cloudflare and started proxying my DNS records for all traffic to my domain but it seems one user is experiencing issues connecting to the Emby server from the app. Switching my emby subdomain from proxied to DNS only seems to be the only thing that fixes the issue. The user that is having issues is using the emby app on a LG TV. I'm having no issues connecting to the Emby server on all of the other platforms I tested. This LG tv was also having issues connecting to the emby server back when I was using LetsEncrypt as a SSL certificate provider if that matters. I can provide whatever info that's needed. Just didn't know what that would be.

When ever I try to log into my cloudflare account with chrome, I keep getting and msg to refresh the page and can never log in. If I try with firefox, I have no issues. I have tried purging my cache/history and that sort of thing and no joy. I can get into my emby server with any brower just fine. Its just that I have to use firefox to log into cloudflare. Has anyone had this issue?

Hello, I'm hosting my Emby server through Cloudflare which is connected to my router. With that I got https and my IP is hidden when I use ping. But is there a possibility that you can blacklist direct IP connections like 94.***.***.* through Emby. So that I only am able to use my Cloudflare domain. And not my router IP. Kind Regards, Ryon

A couple of days ago I posted a thread about how my website was failing to load when using SSL. I've finally figured out what the problem was. Since I use CloudFlare as my DNS for domain I use their SSL, Caching, etc. However, when I disable SSL and set the domain to not go through CloudFlare servers (by making the cloud on the DNS page turn grey) so it bypasses everything except basic DNS. Now Emby works flawlessly without any issues. I am a bit bummed that I cannot use CloudFlare for SSL but now everything is working. Does Emby support CloudFlare or is my hosting provider not liking CloudFlare? Thanks, Gabriel Gulla emby-server-2-1-16.pdf