Inconsistency while login to services through my reverse proxy

[Javier Fernandez Romeo]

Hello all.

I have my Jellyfin server behind a reverse proy (NPM), a dynamic DDNS provider (DuckDNS) and I am out of CG-Nat.

Everytime I try to log in, via web or app, I have to retry several times (sometimes I get in at the first try, sometimes I need to hit login 4 or 5 times in a row until it succeeds).

I guess it has something to do with timeout limits and the such, but I have no idea where to look at. The NPM logs does not help.

If I try to login to the service while on the same LAN (or through tailscale), there is no problem at all, but when accessed from the internet is when the logins are inconsistent, so I have isolated the reverse proxy as the main reason for the malfunctioning behaviour.

My NPM docker compose is as follows (machine A)

services:
  nginx-proxy-manager:
    container_name: nginx-proxy-manager
    image: jc21/nginx-proxy-manager:latest
    ports:
      - "82:80"
      - "81:81"
      - "83:443"
    volumes:
      - ${DATA_DIR}/nginx-proxy-manager:/data
      - ${DATA_DIR}/nginx-proxy-manager/logs:/data/logs
      - ${DATA_DIR}/nginx-proxy-manager/letsencrypt:/etc/letsencrypt
      - ${DATA_DIR}/nginx-proxy-manager/snippets:/snippets
      - /etc/localtime:/etc/localtime:ro
    environment:
      - TZ=${TZ}
    restart: always
    network_mode: bridge
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
networks:
  default:
    external: true
    name: nginx-proxy-manager

And my Jellyfin docker compose instance (machine B):

services:
  jellyfin:
    image: jellyfin/jellyfin:latest
    container_name: jellyfin
    user: ${PUID}:${PGID}
    group_add:
      - "105" #render
      - "44" #video
      - "102" #input
    network_mode: 'host'
    volumes:
      - ${DATA_DIR}/jellyfin/jellyfin:/config
      - ${DATA_DIR}/jellyfin/jellyfin/cache:/cache
      - ${MEDIA_DIR}/peliculas:/peliculas:ro
      - ${MEDIA_DIR}/series:/series:ro
    restart: unless-stopped
    environment:
      - JELLYFIN_PublishedServerUrl=${JELLYFIN_PUBLISHED_SERVER_URL}
      - TZ=${TZ}
    devices:
      - /dev/dri:/dev/dri
    extra_hosts:
      - "host.docker.internal:host-gateway"
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
networks:
  default:
    external: true
    name: nginx-proxy-manager

In trusted proxies under network settings, I have the following subnets as recommended in the Jellyfin "Important notes" on 10.10.7 release (LAN, Tailscale, Docker, Localhost)

192.168.0.0/16, 100.0.0.0/8, 172.0.0.0/8, 127.0.0.1

Thanks in advance.

[TheDreadPirate]

Did you check "Cache Assets" in Nginx? What do you have under the advanced tab?