wp-login behind nginx reverse-proxy inaccessible — bad redirect?

i’ve setup WordPress on a local nginx backend instance. the backend url is

https://wp.example.com:12345/

it’s served through a frontend, nginx reverse proxy, exposed at a subdir. the frontend url is

https://example.com/cms

wp-config.php includes

define('WP_HOME',   'https://example.com/cms');
define('WP_SITEURL','https://example.com/cms');
$_SERVER['REQUEST_URI'] = str_replace("/wp-admin/", "/cms/wp-admin/",  $_SERVER['REQUEST_URI']);
$_SERVER['REQUEST_URI'] = str_replace("/wp-login/", "/cms/wp-login/",  $_SERVER['REQUEST_URI']);

if i nav to

https://example.com/cms

I see the usual/expected

”
Hello world!
Welcome to WordPress. This is your first post. Edit or delete it, then start writing!
“

But if I nav to LOGIN

https://example.com/cms/login

I’m redirected to

https://wp.example.com/login/

which is the backend, without the port (12345), and of course fails

“Unable to connect”

Proxy to the frontpage obviously works.

Proxy to the login page fails, with that^ incorrect redirect.

There’s a config or rewrite missing.

What/where needs to change to fix that login redirect?