Jellyfin with traefik no webinterface black screen

[Rifmaster]

Hi,

I am having a strange issue. Jellyfin installed on Truenas via docker. Jellyfin local working fine. But when i try to access jellyfin via my domain using traefik the loading of the page takes long but the screen remains black. This was working before without issues. All other applications using the same traefik settings all work fine. 
Anyone has a idea what might trigger this issue?

  jellyfin:
    image: lscr.io/linuxserver/jellyfin:latest
    container_name: jellyfin2
    environment:
      - PUID=950
      - PGID=950
      - TZ=Europe/Amsterdam
    volumes:
      - /mnt/Tank/docker/jellyfin2/libaryconfig
      - /mnt/Tank/docker/jellyfin2/cachecache
      - /mnt/Tank/mediadata/media
    ports:
      - 8097:8096
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.jellyfin.entrypoints=http"
      - "traefik.http.routers.jellyfin.rule=Host(jellyfin.******.eu)"
      - "traefik.http.middlewares.jellyfin-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.jellyfin.middlewares= jellyfin-https-redirect"
      - "traefik.http.routers.jellyfin-secure.entrypoints=https"
      - "traefik.http.routers.jellyfin-secure.rule=Host(jellyfin.*****.eu)"
      - "traefik.http.routers.jellyfin-secure.tls=true"
      - "traefik.http.routers.jellyfin-secure.service=jellyfin"
      - "traefik.http.services.jellyfin.loadbalancer.server.port=8096"
      - "traefik.http.middlewares.jellyfin-headers.headers.sslredirect=true"
      - "traefik.docker.network=proxy"
    networks:
      proxy:

networks:
  proxy:
    external: true

[brosce]

If Jellyfin works directly but shows a black screen through Traefik, the issue is almost certainly in the proxy setup. Websocket or header misconfiguration is usually the culprit.

[TheDreadPirate]

Up front, I only have a passing familiarity with Traefik. We have Traefik documentation located at the link below.

https://jellyfin.org/docs/general/post-i...y/traefik/

A couple of things I see, why are you mapping a different external port? Are you running Emby? Or a second Jellyfin instance? I'm assuming that is for local clients only.

Regarding the actual Traefik config, the one that stands out is traefik.http.routers.jellyfin.entryPoints. Our documentation has that set to secure while you have it set to http. You also don't have some headers set. Not sure if those are just for security purposes or if they're required.

[coy]

No immediate solution, that depends on your traefik setup.
Two things that caught my eye:
1 you don't need to map any ports, that for when you don't use a reverse proxy.
2 you have a LOT of labels, in contrast here's my labels:

Code:

labels:
      - traefik.enable=true
      - traefik.http.routers.jellyfin.rule=Host(`jellyfin.${DOMAIN}`)
      - traefik.http.routers.jellyfin.entrypoints=websecure
      - traefik.http.services.jellyfin.loadbalancer.server.port=8096

A lot of what you're doing in the application labels (redirecting, tls, assign cert) can be done centrally in traefik compose.yaml:

Code:

  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    network_mode: traefik-proxy
    command:
      - --log.level=INFO
      - --accessLog.bufferingSize=100

      # Enable Docker provider and set it to only expose containers with the appropriate label
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.endpoint=unix:///var/run/docker.sock
      # Dashboard and API
      - --api

      # Set up LetsEncrypt certificate resolver
      - --certificatesresolvers.letsencrypt.acme.dnschallenge=true
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare
      - --certificatesResolvers.letsencrypt.acme.dnschallenge.delayBeforeCheck=10
      - --certificatesresolvers.letsencrypt.acme.email=${EMAIL_ADDRESS}
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      #- --certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory #comment out after testing
      - --serversTransport.insecureSkipVerify=true # Accept insecure (self-signed) certs

      # Set up an insecure listener that redirects all traffic to TLS
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entryPoints.web.http.redirections.entrypoint.permanent=true

      # Set up the TLS configuration for our websecure listener
      - --entrypoints.websecure.address=:443
      - --entrypoints.websecure.http.tls.certResolver=letsencrypt
      - --entrypoints.websecure.http.tls.domains[0].main=${DOMAIN}
      - --entrypoints.websecure.http.tls.domains[0].sans=*.${DOMAIN}
    secrets:
      - cloudflare-token
      - cloudflare-email
    environment:
      - CF_API_EMAIL_FILE=/run/secrets/cloudflare-email
      - CF_DNS_API_TOKEN_FILE=/run/secrets/cloudflare-token
    ports:
      - 80:80
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${DATA}/traefik/letsencrypt:/letsencrypt
      - ${LOG}/traefik/logs:/logs
    healthcheck:
      test: netstat -ptan | grep -E "443.*LISTEN" || exit 1
      interval: 10s
      timeout: 3s
      start_period: 60s
    labels:
      - traefik.enable=true
      - traefik.http.routers.traefik.rule=Host(`titan.${DOMAIN}`)
      - traefik.http.routers.traefik.service=api@internal
      - traefik.http.routers.traefik.middlewares=admin