Unable to connect over NGINX with cloudflare

Describe the goal

My main domain (foo.com) is used for multiple purposes. Thus, I'd like to add a domain (bar.foo.com) to use for wstunnel. My setup is: Foreign <=> Cloudflare <=> NGINX (a.b.c.d) <=> Wstunnel (e.f.g.h)

Describe what does not work

When testing the websocket locally:

curl -i -N   -H "Connection: Upgrade"   -H "Upgrade: websocket"   -H "Sec-WebSocket-Version: 13"   -H "Sec-WebSocket-Key: $(echo -n 'randomkey123' | base64)" --http0.9  http://localhost:3932 --output -

2

When attempting to test remotely I get a 502 error, and get the following in error logs:

2026-02-04T00:22:40.607689Z ERROR cnx{peer="a.b.c.d:41390"}: wstunnel::tunnel::server::server: error while accepting TLS connection received corrupt message of type InvalidContentType

Describe your wstunnel setup

Command line used: /home/app/wstunnel server --restrict-to localhost:51825 wss://0.0.0.0:3932 inside docker container with port passthrough.

My nginx config:

upstream server_backend {
        server e.f.g.h:3932;
}

server {
    listen 443 ssl;

    server_name bar.foo.com;

    ssl_certificate /etc/ssl/foo.pem;
    ssl_certificate_key /etc/ssl/foo.key;

    access_log /var/log/nginx/wstunnel.success.log;
    error_log /var/log/nginx/wstunnel.error.log;



location / {

    proxy_pass http://server_backend;
    proxy_http_version 2;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_cache_bypass $http_upgrade;
    proxy_read_timeout 86400;  # Prevent timeout
}
}