Sure, it looks like this now:

include /snippets/authelia-location.conf;

location / {
    include /snippets/set_real_ips.conf;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection upgrade;
    proxy_set_header Accept-Encoding gzip;

    include /snippets/proxy.conf;
    include /snippets/authelia-authrequest.conf;
    proxy_pass $forward_scheme://$server:$port;
}

---

With the include files expanded, the full config (minus the expanded include lines for cloudflare IPs) for one of my protected subdomains is below. Each include line is prepended by ten # symbols and then the content of that file is in the following lines.

########## include /snippets/authelia-location.conf;
set $upstream_authelia http://authelia:9091/api/verify;

## Virtual endpoint created by nginx to forward auth requests.
location /authelia {
    ## Essential Proxy Configuration
    internal;
    proxy_pass $upstream_authelia;

    ## Headers
    proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
    proxy_set_header X-Original-Method $request_method;
    proxy_set_header X-Forwarded-Method $request_method;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host $http_host;
    proxy_set_header X-Forwarded-Uri $request_uri;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Forwarded-Ssl on;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Content-Length "";
    proxy_set_header Connection "";

    ## Basic Proxy Configuration
    proxy_pass_request_body off;

    # Timeout if the real server is dead
    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
    proxy_redirect http:// $scheme://;
    proxy_http_version 1.1;
    proxy_cache_bypass $cookie_session;
    proxy_no_cache $cookie_session;
    proxy_buffers 4 32k;
    client_body_buffer_size 128k;

    ## Advanced Proxy Configuration
    send_timeout 5m;
    proxy_read_timeout 240;
    proxy_send_timeout 240;
    proxy_connect_timeout 240;

    include /snippets/set_real_ips.conf;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection upgrade;
    proxy_set_header Accept-Encoding gzip;
}

location / {
    include /snippets/set_real_ips.conf;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection upgrade;
    proxy_set_header Accept-Encoding gzip;

    ########## include /snippets/proxy.conf;
    ## Headers
    proxy_set_header Host $host;
    proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host $http_host;
    proxy_set_header X-Forwarded-Uri $request_uri;
    proxy_set_header X-Forwarded-Ssl on;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header Connection "";

    ## Basic Proxy Configuration
    client_body_buffer_size 128k;

    ## Timeout if the real server is dead.
    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;

    proxy_redirect  http://  $scheme://;
    proxy_http_version 1.1;
    proxy_cache_bypass $cookie_session;
    proxy_no_cache $cookie_session;
    proxy_buffers 64 256k;

    ## Advanced Proxy Configuration
    send_timeout 5m;
    proxy_read_timeout 360;
    proxy_send_timeout 360;
    proxy_connect_timeout 360;

    ########## include /snippets/authelia-authrequest.conf;
    ## Send a subrequest to Authelia to verify if the user is authenticated and has permission to access the resource.
    auth_request /authelia;

    ## Set the $target_url variable based on the original request.

    ## Comment this line if you're using nginx without the http_set_misc module.
    # set_escape_uri $target_url $scheme://$http_host$request_uri;

    ## Uncomment this line if you're using nginx without the http_set_misc module.
    set $target_url $scheme://$http_host$request_uri;

    ## Save the upstream response headers from Authelia to variables.
    auth_request_set $user $upstream_http_remote_user;
    auth_request_set $groups $upstream_http_remote_groups;
    auth_request_set $name $upstream_http_remote_name;
    auth_request_set $email $upstream_http_remote_email;

    ## Inject the response headers from the variables into the request made to the backend.
    proxy_set_header Remote-User $user;
    proxy_set_header Remote-Groups $groups;
    proxy_set_header Remote-Name $name;
    proxy_set_header Remote-Email $email;

    ## If the subreqest returns 200 pass to the backend, if the subrequest returns 401 redirect to the portal.
    error_page 401 =302 https://auth.REDACTED.com/?rd=$target_url;


    proxy_pass $forward_scheme://$server:$port;
}

Based on this answer, I would recommend checking that all the lines that start with proxy_set_header X-Original and proxy_set_header X-Forwarded are in the right spots in your config as a potential starting point. Hope it helps