Native clients (mobile, TV, desktop) DO route through Caddy via FQDN, but cannot complete Authelia's browser-redirect login flow -- they get a 302 to auth.DOMAIN and fail. `import authelia` breaks all native clients. Correct setup is Case 4: Caddy terminates TLS, import accesslog for fail2ban, NO import authelia. Plex/Emby token auth handles access control. https://claude.ai/code/session_012eTokAaGiZo7aGt1T2W9BC