Unable to setup PMS with docker via ssh tunnel proxy

[carsten_burgard]

I already have 2 instances of PMS running, one on my local computer, one on a hired machine.
Now I’m trying to setup a third one, this time using a docker container.
Unfortunately, I find it extremely difficult to get it running.

Short Version

When accessing my new machines WebUI via a (proxied) browser, I seem to always either be denied access or end up at the wrong plex instance.

Long Version

I’m using the following docker-compose.yml:

version: '2'
services:
  plex:
    container_name: plex
    image: plexinc/pms-docker
    restart: unless-stopped
    environment:
      - TZ="Europe/Berlin"
    network_mode: host
    volumes:
      - /home/cburgard/plex/config:/config
      - /tmp/:/transcode
      - /home/cburgard/media:/data

Then I run “docker-compose up” and I can see it starting. All good so far.

Now I open an ssh tunnel to the machine like this:
ssh -N -D 9090 themachineip

I open my browser (firefox) and configure a SOCKS proxy like this:
Manual proxy configuration
SOCKS proxy 127.0.0.1 : 9090
check Proxy DNS when using SOCKS v5

Quick check: googling “what is my IP” with the proxied firefox tells me the IP of the machine (as given in the line where I opened the tunnel). Proxy seems to be working.

So far so good. I go to
themachineip:32400/web
in the proxied browser.
Sanity check: As long as the plex instance on the new server is not running, I don’t see anything here- so far so good.
When the plex container is running though, one of two things can happen:

1. I see “No soup for you! You do not have access to this server”. Not sure why the setup wizard doesn’t show up, but okay. Should I be logged in? Maybe my firefox still has a cookie that forces me to be logged in? No idea.
2. I get immediately forwarded to my existing plex instance on the other server that I run, while I still see the correct IP in the address bar. How is this even possible?

Either way, however I try to approach it, I can’t seem to make the setup wizard appear. Am I being stupid about this? Is this a bug? What am I doing wrong?

Any help greatly appreciated!

[ChuckPa]

In these cases, Docker containers must use the PLEX_CLAIM token in the yaml compose file

It attaches to your account as it is created.

This is necessary because , unless it’s on your LAN, there is no way to be on the same subnet it is.

[carsten_burgard]

Thanks a lot for the suggestion! I’ve tried that just now, and it doesn’t seem to change anything. The result I get is the same as (2).

[ChuckPa]

How did you do that?

Did you edit out the old PlexOnlineUsername, PlexOnlineToken, PlexOnlineEmail. PlexOnlineHome from Preferences.xml before attempting to claim ?

[carsten_burgard]

No, I just added
- PLEX_CLAIM=claim-SoMeCoDe
to the docker-compose yml and removed the entire config folder.
What else should I do?

[ChuckPa]

1. Make certain to remove the docker-based server from authorized devices before starting (you might have multiple now). Clean that all up

2. get the token (you have 5 minutes before it expires)

3. Set in the compose

4. Spin it up fresh container

[carsten_burgard]

Hi!
Thanks a lot for the detailed instructions.
I removed all devices which I could not identify as the ones I’m currently using locally from the list of authorized devices (thanks for the pointer, there were quite a lot of them!)
I stopped and removed the old container.
I removed the whole config folder (again).
I obtained a new token and added it in the compose.
I started a new container.
I opened my proxied firefox to configure it.
I checked that the IP matches.
I opened the local plex app on the proxy.
Still no luck, I just end up at what seems to be the hosted plex app, no setup wizard in sight.

I tried the same (repeated all the steps) with an anonymous browser window in the end, just to make sure that it’s not some cookie shenanigans. Still, same result.

One point of information: I use the “log in with google” method to authenticate with Plex. Perhaps that is causing the issue somehow?

Is there a list of troubleshooting items which would allow me to identify if this is related to any security issue (e.g. ports not properly opened)?

Is there a way to edit the config to perform the setup “by hand” and just set the server name and allow remote connections? Maybe that could be a way to just “skip” the config step and instead access the server via the hosted web app and configure it from there…

[pshanew]

Do you you see the same behavior if you establish your proxy the connection via SSH using this method instead:
ssh user@remote_ip -L 8888:127.0.0.1:32400

Then, in your local browser, navigate to http://127.0.0.1:32400/web.

The way you’re setting up the connection currently, when you connect to Plex Media Server it sees the destination IP address as its (I assume) public IP address; that won’t work for initial setup. Using the method above, PMS will see the destination IP address as 127.0.0.1 and should present the initial setup wizard.

The reason for this is that Plex Media Server expects a couple of things to be true for the initial configuration:

1. That it be performed from the local system or from a system on the same network.
2. If done from a different system, it must be on an RFC-1918 network.

I don’t believe the above will work if you use bridge networking for your container (it looks like you’re using host networking, so you should be good).

Note: You may want to rename your existing Preferences.xml file (and restart the container) before doing this to ensure it is seen as a new installation.

[carsten_burgard]

Hi!
Thanks so much, this finally worked!

As a side note for whoever reads this, however, I needed to additionally:

• force firefox to allow proxying 127.0.0.1 connections by changing the network.proxy.allow_hijacking_localhost to true in about:config
• stop the Plex instance I was running locally to avoid me being forwarded to my actual localhost plex instance after the authentication temporarily routet me via https://app.plex.tv/auth

All of this was highly non-trivial, and I think that had I not been a person working in tech with a good measure of natural curiosity and technical problem-solving abilities, I would have given up long ago.

TL;DR: This process definitely needs to be made easier, with more explicit mentions of these pitfalls in the online guides!