Public Access: Tunnels, Reverse Proxy, ngrok

When the standard “open port 443, run Let’s Encrypt” path doesn’t work for you, Orbitr supports three fallbacks: a Cloudflare Tunnel, ngrok for quick public sharing, or a reverse proxy / custom cert workflow you maintain yourself.

What You’ll Need

• A running Orbitr server with the admin panel open
• One of:
  • Cloudflare Tunnel: a free Cloudflare account (and cloudflared for named tunnels)
  • ngrok: a free ngrok account
  • Reverse proxy: a machine to terminate TLS upstream (Caddy, nginx, traefik), or DNS-01 issuance via your DNS provider’s API

Pick a Method

winget install Cloudflare.cloudflared

cloudflared tunnel login
cloudflared tunnel create orbitr

cloudflared tunnel route dns orbitr chat.yourdomain.com

tunnel: <YOUR_TUNNEL_ID>
credentials-file: ~/.cloudflared/<YOUR_TUNNEL_ID>.json

ingress:
- hostname: chat.yourdomain.com
  service: https://localhost
  originRequest:
    noTLSVerify: true
- service: http_status:404

cloudflared tunnel run orbitr

ngrok config add-authtoken YOUR_TOKEN

ngrok http https://localhost:443

TLS_MODE=off
PORT=4113
PUBLIC_URL=https://chat.example.com

chat.example.com {
reverse_proxy 127.0.0.1:4113
}

server {
listen 443 ssl http2;
server_name chat.example.com;

ssl_certificate     /etc/letsencrypt/live/chat.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/chat.example.com/privkey.pem;

location / {
  proxy_pass http://127.0.0.1:4113;
  proxy_set_header Host $host;
  proxy_set_header X-Forwarded-For $remote_addr;
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";
}
}

TLS_MODE=custom
TLS_CERT_PATH=/etc/ssl/orbitr/fullchain.pem
TLS_KEY_PATH=/etc/ssl/orbitr/privkey.pem

Comparison

Troubleshooting

cloudflared not found — install it yourself (winget install Cloudflare.cloudflared) or download it from Cloudflare’s downloads page , then verify with cloudflared --version.

Tunnel failed to start — check internet, ensure nothing else is using the port, your firewall may block outbound. Confirm cloudflared tunnel list shows yours.

URL not reachable — named tunnel not running; DNS not set (run cloudflared tunnel route dns).

Reverse-proxy: certificate validation issues — if Orbitr reads your custom PEM but browsers complain, the chain is likely incomplete. Use the fullchain.pem (cert + intermediates), not just the leaf.

TLS_MODE=custom and the server won’t start — with custom TLS there is no self-signed fallback: if the cert or key path is missing or unreadable, the server fails to boot rather than starting insecurely. Check the boot log for the cert/key error, confirm TLS_CERT_PATH and TLS_KEY_PATH are set to absolute paths, and check file permissions so the server process can read them.

ngrok works but voice doesn’t — ngrok’s free tier proxies HTTPS, not UDP. WebRTC voice traffic uses UDP and can’t tunnel through. Use a Cloudflare Tunnel or a custom domain with port forwarding for voice support.

Privacy

All traffic passes through a third party when using a tunnel (Cloudflare or ngrok). The connection from users to that party is encrypted (HTTPS). Their privacy policy governs handling of metadata. Your identity is unaffected: your keys are generated and held on your own device, and you authenticate by signing a challenge — a tunnel provider can’t read or forge them. (Per-channel and DM end-to-end content encryption is on the roadmap, not yet available; today message content is protected in transit by HTTPS and stored on the server you chose.)

For direct connections where no third party handles traffic, use a custom domain with port forwarding.

Related

• Custom Domain Setup — the standard path when port 443 does work, with HTTPS automatic
• IP Masking — combine these methods with VPS reverse proxy for stronger IP privacy