Connections & verification

Simple Cloudflare setup#

You need your own Cloudflare account, an existing configured tunnel and an HTTPS hostname that routes to the local Media Center.

1. Open Connections in native Administration.
2. In Cloudflare's tunnel Add a replica → macOS flow, copy the actual connector installation command.
3. Paste it into Installation command. The field is an optional replacement if a protected credential already exists.
4. Enter Public HTTPS address for that tunnel.
5. Ensure the hostname route uses HTTP to the actual local origin shown in the panel, normally http://127.0.0.1:3615, and DNS selects the same tunnel ID.
6. Select Connect & verify. Read each stage rather than accepting edge connectivity alone.

Lumio extracts the token from an allowlisted command shape; it does not execute pasted shell scripts. It uses its bundled connector without requiring a system sudo installation. Never put a token in a screenshot, support message or website source.

Connection-check meanings#

Check	What it proves
Cloudflare account API	Optional advanced API monitoring. It is not required for normal connector-token setup.
Connector process	A Lumio-owned process is running, or another service needs attention.
Tunnel identity & edge	The connector reports the expected tunnel identity and edge readiness.
Hostname route	A matching origin route was received or a request reached this exact Lumio instance.
Local Media Center	The local origin responds and the media engine is ready.
Public HTTPS endpoint	An actual HTTPS page and health request reached this same running server instance.

Check local and public connection refreshes bounded checks and their timestamp. The saved public URL alone proves nothing. A transient startup check may need refreshing after the connector registers. Stop remote connector confirms stopping the owned child and retains its saved credential; it does not delete the Cloudflare tunnel.

Advanced network settings#

Expand Advanced network settings & optional API monitoring. Media Center port accepts 1024–65535 (default 3615). Who can connect? offers This Mac only · loopback, or Other devices · HTTPS reverse proxy. Secure public or LAN origin is the exact trusted HTTPS origin for the second mode. Save connection settings; the panel's background-service restart action applies host/port changes and requires signing in again.

The simple HTTPS-address flow applies its public origin immediately. Advanced port/bind changes require the service restart. Remote access explains why a LAN IP alone is insufficient in this UI.