dial tcp [::1]:80: connect: connection refused
A 502 came from the tunnel ingress pointing at http://localhost:80, which inside Docker is the cloudflared container itself; using the Compose service name (http://nginx:80) fixed
Invalid origin!
With n8n behind nginx on a non-default port (8443 in our test), proxy_set_header Host $host; drops the port from Host, while the browser's Origin keeps :8443. n8n rejects the /rest
Your n8n server is configured to use a secure cookie, however you are either visiting this via an insecure URL, or using Safari.
Opening n8n over plain HTTP through nginx (http://repro.local:8081/) showed the full-page secure cookie warning, because n8n's auth cookie is Secure by default. A 301 from the HTTP
Cannot POST /n8n/webhook/repro-hook
With n8n published under the nginx sub-path /n8n/, an active webhook returned 404 Not Found (Cannot POST /n8n/webhook/repro-hook) through the proxy but 200 when called directly. Th