I figured out the problem: umbrel makes all calls to it's internal API using http instead of https. since cloudflare tunel runs over https, the browser does not allow for umbrel to "downgrade" the connection and blocks all calls from the front to backend.

To solve that i'd probably need a reverse proxy between umbrel and cloudflared to rewrite all http calls as https calls. That, or rewrite umbrel from scratch.

Anyway, having a software that is incompatible with https by default seems to be a bad security practice. I'm now not entirely sure i want to run this on my network anymore.