Networking guide
Cloudflare Tunnel is great for a lot of apps. Media servers are the exception.
You'll need
Cloudflare's service terms say serving video and large files through its CDN needs its paid media products, like Stream, unless you're an Enterprise customer. Streaming Jellyfin or Plex through a free tunnel runs into that.
You also need your own domain on Cloudflare, and sign-in for your guests means setting up Cloudflare Access on top.
We'll use Jellyfin as the example. Any app with a web page works the same way.
Run this on the machine where Jellyfin runs. The container connects out to Seawise.io, so you don't open any ports on your router.
On Docker Desktop for Mac or Windows, replace --network host with -p 8082:8082.
$ docker run -d --name seawise \ --restart unless-stopped \ --network host \ -v seawise-data:/config \ ghcr.io/seawise-io/seawise-client:latest
✓ Container started
On a computer at home, open http://your-server-ip:8082 and create a password for the container's page.
Give the server a name, click Connect, and approve it in the seawise.io tab that opens. Sign up for free there if you haven't yet.
Fill in the name, the address and the port Jellyfin uses (8096 by default), then click Add.
--network host, use localhost. On Docker Desktop, use host.docker.internal. If Jellyfin runs on another machine, use its local IP, like 192.168.1.20.Jellyfin now shows on your Servers page at seawise.io. Click it from any browser, on any network, and you're in.
Go to Portals, create one (say, Family), and add Jellyfin to it. Then open its sharing settings and add the email of everyone who should get in.
Skip this step if Jellyfin is just for you.
Send them the portal link. They sign in with the email you added, using Google, GitHub or an email link, and tap Jellyfin. Nothing to install, on any phone, tablet or laptop.
The container can't reach the app at the address you entered. On the server, check the app opens at http://localhost:PORT. If it runs in another container without host networking, use the server's local IP.
They signed in with a different email than the one you added. Ask which email they used, or add that one too.
Once Jellyfin works through Seawise.io, remove its public hostname from your Cloudflare tunnel so it isn't reachable two ways.