Public scheme is HTTPS (host nginx terminates TLS in front of caddy). Drasl builds absolute URLs — texture URLs and the authlib-injector API location — from BaseURL, so an http:// value caused mixed-content blocking and broken login on the https origin. Point BaseURL at https://auth.${BASE_DOMAIN}. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>