Using reverse proxy breaks login

[nirenjan]

I'm probably doing something wrong here, so I don't want to open an issue as such. I have Caddy as a reverse proxy in front of my services, with the following Caddyfile config (sanitized):

*.int.example.com *.example.com {
        @airtrail {                                                                                                                                                                                                                          
                host airtrail.int.example.com airtrail.example.com
        }

        handle @airtrail {
                reverse_proxy localhost:1380
        }
}

I get the following response when I try to login:

{"message":"Cross-site POST form submissions are forbidden"}

This is the relevant snippet from .env

ORIGIN=https://airtrail.int.example.com
PROTOCOL_HEADER=x-forwarded-proto
HOST_HEADER=x-forwarded-host

I don't have a problem if I set the ORIGIN to http://10.x.y.z:1380, (10.x.y.z is the IP address of the Airtrail host), but I need to use the IP address directly.

On a related note, for reasons, I use two different IPs, one 10.0.0.0/8 while I'm on my home network, and a 100.64.0.0/10 IP used by my VPN. The *.int.example.com and *.example.com DNS wildcards point to the LAN IP and the VPN IP respectively. However, while other services such as Paperless-NGX allow me to specify multiple domain addresses, it seems like Airtrail only allows me to specify a single domain/IP from which i can login.

Now, I have no experience with web development, and while it is easy for me to say "Disable CSRF protection", I don't know what the impact of that decision is. I'm hoping you or the community can help here.