Ory Kratos session cookie domain and secure flag for production behind a reverse proxy

Goal

I am moving an Ory Kratos deployment from local development to production. Locally, Kratos runs on http://localhost with a default configuration and the self-service login flow works: after login, the ory_kratos_session cookie is set and subsequent requests are authenticated.

In production, Kratos sits behind a reverse proxy that terminates TLS and serves traffic on a public domain such as https://auth.example.com. The same configuration that works locally does not appear to establish a session there: after submitting the login form, the browser is sent back to the login page instead of reaching the authenticated application.

Constraints and uncertainty

My understanding is that Kratos derives the cookie domain from the request host when cookie.domain is unset, and that cookie.secure defaults to false. It is unclear to me how these two settings interact with a proxy that forwards (or fails to forward) the original Host header, and whether both must be set explicitly for any non-localhost deployment.

Questions

1. Which cookie.domain value should be used when Kratos and the login UI are served on different subdomains of the same parent domain?
2. Does cookie.secure=true remain correct when TLS is terminated at the proxy and Kratos itself only sees plain HTTP?
3. What proxy headers must be forwarded so Kratos determines the public host and scheme correctly?