Weird problem with emby server and reverse proxy

[Bagufr 5]

Hello,

I'm having a rather strange problem.
I've bought an Emby Premiere licence, and locally everything's fine.
On the other hand, using emby on my synology nas, I use a reverse proxy to access it from outside with one of my sub-domains.
Everything is fine, except that when I access it via my domain name, the "premiere" version is not detected.

Do you have any idea how to solve the problem?
Thanks

[Luke 37070]

HI there, what makes you think the Premiere version isn't' detected?

[Bagufr 5]

The big logo "Obtain Emby Premiere" and some options in admin section not available. (Available when access from the same account on local lan)
And last, theme options are not kept between LAN and public access.

[Luke 37070]

Is this in the browser?

[Bagufr 5]

Yes

In firefox and chrome, same result

[Luke 37070]

What address is in the browser address bar?

[Bagufr 5]

When i'm in local lan, i use my synology address (local only) http://172.16.x.y:8096
When i'm outside, i use my domain adress https://myserver.domain.fr

Here is my reverse proxy config :

<VirtualHost *:443>
	ServerName myserver.domain.fr
	SSLEngine on
	H2Direct On
	H2Upgrade On
	
	DocumentRoot ${APACHE_WORK_DIR}/folder/html/emby/

	SSLProxyEngine on
	SSLProxyVerify none
	SSLProxyCheckPeerName off
	SSLProxyCheckPeerCN off
	SSLProxyCheckPeerExpire off
	ProxyAddHeaders off
	ProxyPreserveHost on
	ProxyReceiveBufferSize 4096

	ProxyPass / http://172.16.x.y:8096/ Keepalive=On
	ProxyPassReverse / http://172.16.x.y:8096/ Keepalive=On
	setenv proxy-initial-not-pooled 1

	SSLCertificateFile ${CERT_DIR}/fullchain.cer
	SSLCertificateKeyFile ${CERT_DIR}/cert.key
	SSLCACertificateFile ${CERT_DIR}/cacert.pem
	SSLUseStapling on

	<Directory ${APACHE_WORK_DIR}/folder/html/emby/>
		Options +FollowSymLinks -Indexes +Includes +ExecCGI
		AllowOverride None
		<RequireAll>
			Require all granted
			Require not env BlockCountry
		</RequireAll>
	</Directory>
</VirtualHost>

 

Edited February 2 by Bagufr

[Luke 37070]

Have you compared your reverse proxy settings to this?

I know it's for nginx but most reverse proxies have similar options.

[Bagufr 5]

I don't see any real difference.
Maybe "ProxyAddHeaders off" wich may be set to "on"

I will try and tell you the result : Edit : Same result

Edited February 3 by Bagufr

[Luke 37070]

Can you capture the contents of the browser debug console? Are there any browser extensions installed?

[Bagufr 5]

I don't understand what you need.
But...

I did a test.
I made a reverse proxy directly in the synology NAS.
Since I have a DDNS with a valid lets encrypt certificate, all I have to do is add a redirection of port 9443 in my router.

-- See attached file --

In this configuration, the emby premiere account is detected.

So there is something preventing emby from identifying the subscription when you use a reverse proxy with the above configuration.

If I test a little further, if I go through the apache reverse proxy, I get an error message telling me that no stream is available when I try to read content.
But if I use the nas reverse proxy, everything works perfectly.

[Bagufr 5]

I can send you, but in private, embyserver log file and ffmpeg transcode log file i you want.

[Luke 37070]

On 2/5/2024 at 8:23 AM, Bagufr said:

I can send you, but in private, embyserver log file and ffmpeg transcode log file i you want.

I don't think this is going to help us. I think the question is what's different about your configuration between the two reverse proxies?

[Bagufr 5]

I don't really know

In fact, my original reverse proxy runs under apache. The other runs under nginx on my nas server.
As the problem is too serious, I'm in the process of moving my emby server directly to the web server.

[Luke 37070]

OK please let us know if you find anything. Thanks.

[Bagufr 5]

No problem. Many thanks

[DonMacaroni 24]

Quite interesting, I have pretty similar setup (no DDNS though, but static DNS) and no issues:

 

 @Bagufr I do think, your destination hostname is wrong, though... 

Under the hood, it looks like this:

 

server {
    listen 8888 ssl;
    listen [::]:8888 ssl;

    server_name syno.darktech.lan ;

    if ( $host !~ "(<obfuscated>$)" ) { return 404; }

    include /usr/syno/etc/www/certificate/ReverseProxy_cd582aff-938a-4512-89f6-ac49ebedfcee/cert.conf*;

    include /usr/syno/etc/security-profile/tls-profile/config/ReverseProxy_cd582aff-938a-4512-89f6-ac49ebedfcee.conf*;

    add_header Strict-Transport-Security "max-age=15768000; includeSubdomains; preload" always;

    proxy_ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;

    location / {

        proxy_connect_timeout 60;

        proxy_read_timeout 60;

        proxy_send_timeout 60;

        proxy_intercept_errors off;

        proxy_http_version 1.1;

        proxy_set_header        Host            $http_host;

        proxy_set_header        X-Real-IP            $remote_addr;

        proxy_set_header        X-Forwarded-For            $proxy_add_x_forwarded_for;

        proxy_set_header        X-Forwarded-Proto            $scheme;

        proxy_pass http://localhost:8096;

    }

    error_page 403 404 500 502 503 504 /dsm_error_page;

    location /dsm_error_page {
        internal;
        root /usr/syno/share/nginx;
        rewrite (.*) /error.html break;
        allow all;
    }

}

 

Edited February 13 by DonMacaroni

[Luke 37070]

Hi, did you figure this out?

[Bagufr 5]

Hi, I made a mistake when editing my screenshot. On my nas server, I had localhost as the destination.
But as explained earlier, I moved the emby server.
Now, the emby server is on the same server as the web server and fetches the media from the nas server.
This gives me better performance and makes it easier to manage SSL certificates.

I think I had another problem with certificate management on my synology server. I made some changes on my nas server to get a letsencrypt certificate through the back door.
If I had to do the same thing again, I think everything would work correctly with the synology reverse proxy.

[Carlo 4330]

@BagufrSo you're all good for now correct?

Carlo

[Bagufr 5]

Yes it's fine now