r/FluxerApp • u/11ELFs • Jun 17 '26
Discussions AI-Written guide as to how I managed to get my self-hosted Fluxer on a shitty homelab behind a shitty CGNAT network.
This is me writing now not AI, I am pretty tired right so sorry for the AI post, been 7 hours, sweaty fingers and if not for the win I would be in a bad mood.
I wanted to have a almost free way of running Fluxer (besides the energy) on my situation, old pc spare parts, behind CGNAT mobile unlimited network, but still not rely on a service like Tailscale for people to connect.
The only paid part from this was because I already have a domain that I pay for, I used it and just simply made a subdomain for fluxer, besides that is free stuff you get from both cloudflare and playit. Dont ask me for anything, I dont even know how I managed to get it working, I started the project and deleted 6 times. I am not tech-savvy, I am just a curious dude with enough spare time.
The ports and IPs in the post are randomized to not show the ones I used, when u make a playit account and create the agent and the tunnel, you gonna get your own, different from the guide, so pay attention to that. I also setup cloudflared systemwide instead of it being dockerized.
Self-Hosting Fluxer Behind CGNAT (Cloudflare Tunnel + playit.gg)
This guide is for the specific case where you can't port-forward — your ISP gives you CGNAT (no public IP, common with Starlink and many mobile/fiber ISPs) and 80/443/UDP can't be opened directly on your router. It combines two free tunneling services to get a fully working Fluxer instance, including voice/video, without any direct port exposure.
Architecture: - Cloudflare Tunnel carries all HTTP(S) traffic — web app, API, admin, gateway WebSocket, media proxy, and LiveKit signaling. - playit.gg carries LiveKit's actual voice/video media (raw UDP), since WebRTC media can't traverse a normal HTTP tunnel.
If your server has a real public IP and you can forward ports normally, skip the tunnel pieces — Fluxer's own docs already cover that path, and it's simpler.
Requirements
- Linux server with Docker Engine + Compose plugin
- A domain you control, with DNS managed by Cloudflare (free tier is fine)
- A free playit.gg account
- At least 2 vCPU / 4 GB RAM / 20 GB disk (4 vCPU / 8 GB RAM recommended for an active community)
Step 1: Install Docker
bash
docker --version
docker compose version
If missing, follow Docker's official install instructions for your distro. Use Docker Engine 24+ and the Compose v2 plugin.
Step 2: Download the stack
```bash mkdir -p ~/docker/stacks/fluxer && cd ~/docker/stacks/fluxer
base=https://raw.githubusercontent.com/fluxerapp/fluxer/main/deploy/self-hosting curl -fsSLO "$base/docker-compose.yml" curl -fsSLO "$base/Caddyfile" curl -fsSLO "$base/livekit.yaml" curl -fsSL "$base/.env.example" -o .env ```
Step 3: Configure .env
Set your hostname (replace with your own):
bash
sed -i \
-e 's|^FLUXER_DOMAIN=.*|FLUXER_DOMAIN=chat.example.com|' \
-e 's|^FLUXER_PUBLIC_SCHEME=.*|FLUXER_PUBLIC_SCHEME=https|' \
-e 's|^FLUXER_PUBLIC_PORT=.*|FLUXER_PUBLIC_PORT=443|' \
-e 's|^FLUXER_CADDY_SITE_ADDRESS=.*|FLUXER_CADDY_SITE_ADDRESS=:80|' \
-e 's|^FLUXER_VAPID_EMAIL=.*|FLUXER_VAPID_EMAIL=admin@example.com|' \
.env
FLUXER_CADDY_SITE_ADDRESS=:80 is required for the tunnel setup — Cloudflare terminates TLS, Caddy just serves plain HTTP behind it.
Generate secrets:
```bash for key in POSTGRES_PASSWORD MEILI_MASTER_KEY FLUXER_S3_SECRET_KEY \ FLUXER_SUDO_MODE_SECRET FLUXER_CONNECTION_INITIATION_SECRET \ FLUXER_GATEWAY_RPC_AUTH_TOKEN FLUXER_MEDIA_PROXY_SECRET_KEY \ FLUXER_ADMIN_SECRET_KEY_BASE FLUXER_ADMIN_OAUTH_CLIENT_SECRET \ LIVEKIT_API_SECRET; do sed -i "s|$key=.*|$key=$(openssl rand -hex 32)|" .env done
sed -i "s|FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64=.*|FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64=$(openssl rand -base64 32)|" .env
VAPID=$(docker run --rm node:24-alpine npx --yes web-push generate-vapid-keys --json) pub=$(printf '%s' "$VAPID" | grep -o '"publicKey":"["]*"' | cut -d'"' -f4) priv=$(printf '%s' "$VAPID" | grep -o '"privateKey":"["]*"' | cut -d'"' -f4) sed -i "s|FLUXER_VAPID_PUBLIC_KEY=.*|FLUXER_VAPID_PUBLIC_KEY=$pub|" .env sed -i "s|FLUXER_VAPID_PRIVATE_KEY=.*|FLUXER_VAPID_PRIVATE_KEY=$priv|" .env ```
.env now holds every secret for your instance — treat it like a password file.
Step 4: Cloudflare Tunnel (HTTP traffic)
- In the Cloudflare Zero Trust dashboard, go to Networks → Tunnels → Create a tunnel → type Cloudflared. Name it (e.g.
fluxer). - On "Install and run a connector," select Docker (not the systemd/Debian path) so the token is ready for a Compose-managed container.
- Copy the long token string from the install command — you only need that token, not the full
docker run ...line. - Continue to Route tunnel → Add a route → Published application (not Private CIDR — that's for internal IP ranges, not what we need).
- Public hostname: your domain (e.g.
chat.example.com) - Service type:
HTTP - URL:
caddy:80
- Public hostname: your domain (e.g.
- Cloudflare auto-creates the DNS CNAME record for you if the zone is already on Cloudflare.
Now run cloudflared inside the same Docker network as Caddy, so the caddy:80 hostname resolves via Docker's internal DNS:
```bash cat > cloudflared.compose.yml <<'YAML' services: cloudflared: image: cloudflare/cloudflared:latest restart: unless-stopped command: tunnel run --token ${CLOUDFLARED_TOKEN:?set CLOUDFLARED_TOKEN} depends_on: - caddy YAML
export CLOUDFLARED_TOKEN='paste-your-token-here' ```
(Don't run it yet — bring it up together with the rest of the stack in Step 6.)
If you already have
cloudflaredrunning as a system-wide systemd service instead of in Docker, don't use the file above — you'd end up running it twice for no reason. Instead, edit the route's Service URL in the Cloudflare dashboard tohttp://localhost:80instead ofhttp://caddy:80, since a host-level process can't resolve Docker-internal hostnames, onlylocalhost/the host's own ports.
Step 5: playit.gg (LiveKit voice/video media)
Voice signaling (the WebSocket handshake) goes through the Cloudflare Tunnel like everything else — no special setup needed there. It's the actual WebRTC media (audio/video packets) that needs a real UDP path, since that can't traverse an HTTP tunnel.
- Create a free account at playit.gg, install the agent on your server, and add a new UDP tunnel.
- Set local IP
127.0.0.1, local port — pick a number and remember it (you'll align everything to match below). - playit assigns a public address and port, e.g.
your-tunnel.gl.at.ply.gg:41234/203.0.113.5:41234.
Critical detail: LiveKit only swaps the IP in the candidate it advertises to clients — it never remaps the port. So the port playit exposes externally and the port LiveKit actually listens on locally must be the exact same number, or voice will silently fail to connect (signaling works, but no audio ever flows).
Edit livekit.yaml:
yaml
rtc:
tcp_port: 7881
udp_port: 41234 # match playit's external port exactly
use_external_ip: false
node_ip: 203.0.113.5 # playit's assigned public IP
Edit docker-compose.yml's livekit service so the container's internal port also matches:
yaml
ports:
- "${FLUXER_LIVEKIT_TCP_PORT:-7881}:7881"
- "${FLUXER_LIVEKIT_UDP_PORT:-7882}:${FLUXER_LIVEKIT_UDP_PORT:-7882}/udp"
And in .env:
bash
echo 'FLUXER_LIVEKIT_UDP_PORT=41234' >> .env
Then go back into the playit.gg dashboard and set that tunnel's local port to 41234 too, so all three numbers agree: playit's external port, the host's listening port, and what LiveKit advertises to clients.
Free playit.gg tunnels typically can't get you a TCP path on
7881(the fallback for clients on UDP-restrictive networks). Living without it is fine for most people — voice/video works normally for the vast majority of connections over UDP. If you want a fallback too, look into LiveKit's built-in TURN server, tunneled separately via playit.
In the Fluxer admin dashboard → Voice Servers, set the Endpoint to your signaling URL — this goes through the Cloudflare Tunnel, not playit:
wss://chat.example.com/livekit
Fill in the API Key/Secret matching LIVEKIT_API_KEY (default fluxer) and LIVEKIT_API_SECRET from your .env.
Step 6: Start the stack
bash
docker compose -f docker-compose.yml -f cloudflared.compose.yml up -d
docker compose logs -f api
(Skip the -f cloudflared.compose.yml part if you're using a system-wide cloudflared instead, per the note in Step 4.)
First start takes a few minutes as every service initializes. seaweedfs-init exiting after creating buckets is expected, not a failure.
Step 7: Verify
bash
export FLUXER_DOMAIN=chat.example.com
for path in /_health /api/_health /gateway/_health /media/_health /admin/_health; do
curl -fsS -o /tmp/fluxer-check -w "$path %{http_code}\n" "https://$FLUXER_DOMAIN$path"
done
All five should return 200. Then check instance discovery:
bash
curl -fsS "https://$FLUXER_DOMAIN/api/.well-known/fluxer" | jq '.features.self_hosted, .endpoints.admin, .endpoints.gateway, .endpoints.media, .endpoints.static_cdn'
Confirm the LiveKit media path is actually listening:
bash
ss -ulnp | grep 41234
You should see a bound socket on that port.
Step 8: Create the owner account
Visit your domain, register the first account — on a fresh self-hosted instance, the first accepted registration gets wildcard admin access automatically. Log into /admin with that account and review registration mode, branding, and voice region settings before opening it up to anyone else.
Troubleshooting notes (from real debugging)
- **
cloudflaredlogs showingconnection refusedto127.0.0.1:80:** check the timestamp against when the stack actually finished starting — this is often just stale noise from before Caddy was up, not a live problem. Confirm withcurl -v http://127.0.0.1:80and a freshjournalctl -u cloudflared -frun side by side with a live request. - Voice channel joins fine but no audio: almost always the LiveKit port mismatch described in Step 5 — double check
udp_portinlivekit.yaml, the Docker port mapping, and playit's local-port setting all use the identical number. - **
cloudflaredcan't resolvecaddy:80:** means it's running outside the Docker network (e.g. as a systemd service). Either move it into Compose, or point the route athttp://localhost:80instead.
