Short answer: Authelia’s server.asset_path replaces favicon.ico, logo.png, and locale JSON. It has no stylesheet. The portal’s default Content-Security-Policy is style-src ‘self’ ‘nonce-${NONCE}’, so an off-origin CSS URL is refused, and an injected <style> cannot see the per-request nonce. The theme belongs on the reverse proxy: nginx sub_filter inserts a…
Learn extensively, Understand deeply, Discern clearly, and Act resolutely.