Update: solved by switching off Cloudflare to Nginx reverse proxy (without the various funky subdomain tricks I had tried), and updating my nginx.conf to include auth header and cache settings:
Update: solved by switching off Cloudflare to Nginx reverse proxy (without the various funky subdomain tricks I had tried), and updating my nginx.conf to include auth header and cache settings: