How-to: put your Lydex Stream library on the internet with a Cloudflare domain and Tunnel

This is the second way to listen to your home library from anywhere. The Tailscale guide keeps everything inside a private network and needs a VPN app on the phone. The Cloudflare route gives Lydex Stream a normal public address such as https://music.example.com instead: nothing extra on the phone, easy to hand to family, and it works on networks that only allow port 443. The trade-offs are at the end.

Two Cloudflare products do the work, both on the free plan:

Cloudflare Registrar sells domains at wholesale cost (a .com is around 10 USD a year) and parks their DNS on Cloudflare, which is exactly what the tunnel needs.
Cloudflare Tunnel runs a small connector (cloudflared) next to Lydex Stream. The connector dials out to Cloudflare, so nothing is opened on your router, your home IP stays hidden, and Cloudflare terminates HTTPS with a certificate it manages for you.

What you need

Lydex Stream installed and working on your home network. Step 1 of the Tailscale guide covers that; stop once the library shows up in Lydex over Wi-Fi.
A Cloudflare account with a payment method on file (needed to register a domain; the Zero Trust dashboard may ask for one too, even on the free plan, and does not charge you).

1. Get a domain onto Cloudflare

New domain. In the Cloudflare dashboard open Domain Registration › Register Domains, search for a name and check out. The domain is created directly on Cloudflare DNS, so there is nothing else to configure. WHOIS privacy is included, and like every new registration it cannot be transferred away for the first 60 days.

A domain you already own. Add it with Add a site, choose the Free plan, and switch the nameservers at your current registrar to the two Cloudflare gives you. The tunnel can only publish hostnames on a zone whose DNS Cloudflare runs.

2. Create the tunnel

Open the Zero Trust dashboard (one.dash.cloudflare.com; pick a team name and the Free plan the first time), then Networks › Tunnels › Create a tunnel › Cloudflared. Name it after the machine, for example music-server.

The next page shows an install command for each operating system with your tunnel token already filled in. Copy the one for the server and run it there; on Linux it installs the cloudflared package and registers it as a systemd service that starts at boot:

# copy this from the dashboard, the token is unique to your tunnel
sudo cloudflared service install eyJhIjoi...

Once the dashboard shows the connector as Connected, click Next.

3. Publish Lydex Stream on a hostname

On the Public Hostname tab:

Subdomain: music (or anything you like)
Domain: your domain
Type: HTTP
URL: localhost:4545

Save. Cloudflare creates the DNS record for music.example.com itself and issues the certificate within a minute or two. Test from any network:

curl https://music.example.com/api/v1/ping

Lydex Stream serves its API and web console from the same port, so the console is now at https://music.example.com too.

4. Point Lydex at it

In Lydex, open Sources, pick Lydex Stream under Streaming and tap Log in:

Server address: https://music.example.com (no port)
Username / Password: an account created in the Lydex Stream console

Use the same address at home and away. The connection goes out to Cloudflare and back even on your own Wi-Fi, which costs a few milliseconds and makes no difference to playback.

The audio itself is untouched: Cloudflare does not cache Lydex Stream's track URLs and passes range requests straight through, so seeking works and a 24/192 file arrives bit-identical to the one on disk.

5. Lock the front door

A public hostname means the login page faces the whole internet. Lydex Stream has no default password and the tunnel exposes nothing but port 4545, so the remaining risk is password guessing. Three cheap measures:

Rate-limit the login endpoint. Security › WAF › Rate limiting rules (the free plan includes one): when the URI path equals /api/v1/auth/login, allow 5 requests per 10 seconds per IP and block for the maximum period offered. Real users never hit this; a guessing script does on its first second.
Separate accounts. Keep the administrator for the web console and create a plain user in the console for each phone. If a phone is lost, delete that user.
Restrict by country if it fits your life. Security › WAF › Custom rules: block when the country is not one you travel to. Free plans get five such rules.

What not to do: do not put a Cloudflare Access login in front of music.example.com as a whole. Access shows a browser login page, and the Lydex plug-in talks to the API directly, so it would be locked out. If you want Access on the web console only, create one Access application for music.example.com and a second one for music.example.com/api/* with a Bypass policy; Access applies the most specific matching path, so the app keeps working while the console asks for your Google or email login.

Tailscale or Cloudflare?

	Tailscale	Cloudflare Tunnel
On the phone	Tailscale app, VPN permission	Nothing
Who can see your traffic	Nobody, end to end	Cloudflare decrypts at its edge
Exposure	None, private network only	A public login page, mitigated above
Sharing	Invite each person to your tailnet	Give them a Lydex Stream account
Cost	Free	Free, plus the domain (about 10 USD a year)
Dependence	Tailscale coordination servers (Headscale can replace them)	Cloudflare's network

If you are the only listener and do not mind a VPN toggle, Tailscale is simpler. If several people in different places should listen, or you want the library reachable from a locked-down network, Cloudflare is the better fit. Nothing stops you running both: the tunnel on the public hostname and Tailscale for yourself.

If something does not work

Error 1033 in the browser: the tunnel is offline. On the server, systemctl status cloudflared.
Error 502: the tunnel is up but cannot reach Lydex Stream. Check curl http://localhost:4545/api/v1/ping on the server and that the Public Hostname URL is localhost:4545 with type HTTP.
Login works in the browser but not in Lydex: an Access application or a WAF rule is catching the API. Look at Security › Events for blocked requests from your phone's IP.
Just want to try it for five minutes? cloudflared tunnel --url http://localhost:4545 prints a temporary trycloudflare.com address with no account or domain. It changes every run and is for testing only.

Questions or a setup that behaves differently? Reply below.