Consistent Validation Error

[Midnight1938]

Keep getting the following error:

level=INFO msg="starting tsbridge" version=0.12.0 provider=file
level=ERROR msg=error error="failed to create application: configuration error: failed to load config from provider: configuration error: : file provider: validating config: validation error: service \"jellyfin\": validation error: service must have at least one tag when using OAuth authentication"

With a configuration that looks like this

[tailscale]
oauth_client_id_env = "id"
oauth_client_secret_env = "secret"
default_tags = ["tag:server"]
tls_mode = "auto"

[[services]]
name = "books"
backend_addr = "localhost:8070"

[[services]]
name = "jfin"
backend_addr = "localhost:9000"

[[services]]
name = "ppod"
backend_addr = "localhost:9050"

And is being run in a container this way:

sudo docker run -v /DATA/tailscaleSet/:/config   -e TS_OAUTH_CLIENT_ID=id   -e TS_OAUTH_CLIENT_SECRET=key   ghcr.io/jtdowney/tsbridge:latest -config /config/tsbridge.toml

Reading instructions i cannot find any issues, even if i remove jfin, it does nothing

[jtdowney]

The error references a jellyfin, but I don't see a service with that name in the config you posted. Is this the current config you're using?

[Midnight1938]

The error references a jellyfin, but I don't see a service with that name in the config you posted. Is this the current config you're using?

yes, jfin is supposed to be it, i tried changing it to jellyfin to no success, there its unable to set a funnel, and i end up with Bad Gateway. Both are their own files and their own stacks in portainer

Config:

• Jellyfin

name: jellyfin
services:
    jellyfin:
          ...
            tsbridge.enabled: true
            tsbridge.service.name: jfin
            tsbridge.service.funnel_enabled: true 
            tsbridge.service.port: 8096
        ports:
            - target: 8096
              published: "9000"
              protocol: tcp
            - target: 8920
              published: "9001"
              protocol: tcp
            - target: 7359
              published: "9002"
              protocol: tcp
            - target: 1900
              published: "9003"
              protocol: tcp
        ...

• tsbridge:

services:
  tsbridge:
    container_name: tsbridge
    image: ghcr.io/jtdowney/tsbridge:latest
    command: ["--provider", "docker"]
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock # Required for label discovery
      - tsbridge-state:/var/lib/tsbridge
    environment:
      - TS_OAUTH_CLIENT_ID=KEY
      - TS_OAUTH_CLIENT_SECRET=tskey-client
    labels:
      - "tsbridge.tailscale.oauth_client_id_env=TS_OAUTH_CLIENT_ID"
      - "tsbridge.tailscale.oauth_client_secret_env=TS_OAUTH_CLIENT_SECRET"
      - "tsbridge.tailscale.state_dir=/var/lib/tsbridge"
      - "tsbridge.tailscale.default_tags=tag:server" # Must match or be owned by your OAuth client's tag
      - "tsbridge.global.metrics_addr=:9090"
    ports:
      - "9091:9090" # Metrics
volumes:
  tsbridge-state:

time=2025-10-19T17:43:22.530Z level=INFO msg="HTTP request" service=jfin method=GET path=/web/f5bbb798cb2c65908633.png status=502 size=12 duration_ms=6.387 request_id=75b3a82a-7e54-4021-a461-ef8e19d87fbf user_agent="Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0" remote_addr=100.70.218.15:50946

time=2025-10-19T17:46:08.389Z level=INFO msg="http: TLS handshake error from [fd7a:115c:a1e0:ab12:4843:cd96:6268:d02b]:44834: EOF"

• tailscale:

	"tagOwners": {"tag:server": ["autogroup:member"]},

[Midnight1938]

Disabling TLS handshake did not fix the bad gateway issue

[jtdowney]

A bad gateway error means your client was able to connect to tsbridge, but tsbridge was unable to connect to the backend. I'd try exec'ing into the tsbridge container and see if you can ping the backend container.

[Midnight1938]

A bad gateway error means your client was able to connect to tsbridge, but tsbridge was unable to connect to the backend. I'd try exec'ing into the tsbridge container and see if you can ping the backend container.

Ive since gotten it to work
But if i use more than 3 services it cannot detect the 4th ones port, even if i turn off auto detect and define it in the label (it either thinks its 8000, some other service port or nothing)

Not a deal breaking issue since i can put a sidecar on the 4th but a bug nonetheless

[Midnight1938]

The biggest issue is still with jellyfin, even if i define the port, it will not sense it