Traefik with Authelia and Cloudflare: Can't redirect

Traefik Traefik v2
, ,
1

I have Traefik and Authelia in docker containers as well as services I want to access. I use Cloudflare's IP obfuscation proxy and remove the X-Forward-To headers as per Authelia's directions. Certs are provided by LetsEncrypt.

I can access Authelia directly on its subdomain and sign on.
However, I can't get any other services to use Authelia. When I try to access them I get HTTP ERROR 500 and Traefik logs show:

" http: server gave HTTP response to HTTPS client "

I've been banging my head against this wall for two weeks now.
I know there are a lot of moving parts with this set-up so I'm not sure what would be useful to show you to help solve the problem?

version: '3.3'

services:
  authelia:
    image: authelia/authelia
    container_name: authelia
    volumes:
      - /docker-container-data/authelia:/config
    networks:
      #- backend
      - default
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.authelia.rule=Host(`auth.y.z`)'
      - 'traefik.http.routers.authelia.entrypoints=web,websecure'
      - 'traefik.http.routers.authelia.tls=true'
      - 'traefik.http.routers.authelia.tls.certresolver=letsencrypt-dns'
      - 'traefik.http.middlewares.authelia.forwardauth.address=https://authelia:9091/api/authz/forward-auth?authelia_url=https://auth.y.z'  # yamllint disable-line rule:line-length
      - 'traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true'
      - 'traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email'  # yamllint disable-line rule:line-length
    expose:
      - 9091
    restart: unless-stopped
    healthcheck:
      ## In production the healthcheck section should be commented.
      disable: true
    environment:
      - TZ=Europe/London

networks:
  default:
     external: true

Example of service I can't connect to:

  nginx_recipes:
    image: nginx:mainline-alpine
    restart: always
    ports:
      - 84:80
    labels:
    - "traefik.enable=true"
    - "traefik.http.routers.nginx_recipes.entrypoints=web, websecure"
    - "traefik.http.routers.nginx_recipes.rule=Host(`recipes.y.z`)"
    - "traefik.http.routers.nginx_recipes.tls=true"
    - "traefik.http.routers.nginx_recipes.tls.certresolver=letsencrypt-dns"
    - "traefik.http.routers.nginx_recipes.middlewares=authelia@docker"
2

You seem to enable TLS on web and websecure:

I recommend to set it globally on the entrypoint, see simple Traefik example.