LAN, tailnet and tunnel access

[HebelHuber]

I'm setting up cockpit for a machine in my LAN.
I am trying to access it via LAN, tailscale tailnet and cloudflare tunnel.
Ubuntu server 24.04
For now, firewall is disabled with ufw disable

cockpit.conf:

[webService]
Origins = https://COCKPIT_DOMAIN wss://COCKPIT_DOMAIN
ProtocolHeader = X-Forwarded-Proto 
AllowUnencrypted = true

Access URL	result	notes
https://COCKPIT_DOMAIN (cloudflare tunnel -> https://localhost:9090)	❌ error 502	Logs: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
https://COCKPIT_DOMAIN (cloudflare tunnel -> http://localhost:9090)	✅ working
http://TAILNET_IP_OR_HOSTNAME:9090/	❌ endless login loop	nothing logged
https://TAILNET_IP_OR_HOSTNAME:9090/	❌ login fails	After login: Connection failed page. Logs: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
http://LAN_IP_OR_HOSTNAME:9090/	❌ endless login loop	nothing logged
https://LAN_IP_OR_HOSTNAME:9090/	❌ login fails	After login: Connection failed page. Logs: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.

Changing cockpit.conf to this:

[webService]
AllowUnencrypted = true

Access URL	result	notes
https://COCKPIT_DOMAIN (cloudflare tunnel -> https://localhost:9090)	❌ error 502	Logs: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
https://COCKPIT_DOMAIN (cloudflare tunnel -> http://localhost:9090)	❌ login fails	nothing logged. After login: Connection failed page
http://TAILNET_IP_OR_HOSTNAME:9090/	❌ endless login loop	nothing logged
https://TAILNET_IP_OR_HOSTNAME:9090/	✅ working	Logs: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
http://LAN_IP_OR_HOSTNAME:9090/	❌ endless login loop	nothing logged
https://LAN_IP_OR_HOSTNAME:9090/	✅ working	Logs: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.

So tailnet and LAN behave exactly the same. I can't get access via tunnel and tailscale/LAN at the same time. In my internal network I don't need https, and for the tunnel https is handled by the tunnel.

Is there a way to get tunnel and LAN access working?