How do you configure the "Resource root URL" behind a reverse proxy?

[Daniel Schmidt]

The question's in the title — how do you actually configure this?

We run Jenkins behind NGINX. As a first-pass, I simply added our assets domain as an additional server_name to the previous, working server configuration (which is modeled off of the documentation). This doesn't work, however:

• On the configuration page, the entry for Resource Root URL shows the error "An error occurred when checking the instance identity at that URL: 404 Not Found ". If you visit the root URL directly, you get a page saying "HTTP ERROR 404 Jenkins serves only static files on this domain."
• Every asset URL page returns a 403 Forbidden saying that the user lacks the overall/read permission, even though that user should have the permission (and does, at least on the primary domain).

Is there any further documentation about this?