Trying to deploy Soketi on a Forge server

I'm trying to deploy Soketi on my existing Forge server. I added an alias for socket.mydomain.com in cloudflare, created a new SSL that included the alias, and turned the proxy off for just the alias.

This is my Nginx file

server {
    listen 6002 ssl;
    listen [::]:6002 ssl;
    http2  on;
    server_name socket.<mydomain>.com;
    server_tokens off;
    root /home/forge/<mydomain>.com/public;

    ssl_certificate /etc/nginx/ssl/<mydomain>.com/<id>/server.crt;
    ssl_certificate_key /etc/nginx/ssl/mydomain.com/<id>/server.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ...ciphers
    ssl_prefer_server_ciphers off;
    ssl_dhparam /etc/nginx/dhparams.pem;

    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Content-Type-Options "nosniff";

    index index.html index.htm index.php;

    charset utf-8;

    location / {
        proxy_pass http://127.0.0.1:6001;
        proxy_read_timeout 60;
        proxy_connect_timeout 60;
        proxy_redirect off;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }

    access_log /var/log/nginx/socket.<mydomain>.com_access.log;
    error_log /var/log/nginx/socket.<mydomain>>.com_error.log error;
}

This is my /etc/systemd/system/soketi.service

[Unit]
Description=Soketi Server
After=network.target

[Service]
EnvironmentFile=/home/forge/<mydomain>.com/soketi.env
ExecStart=/usr/bin/soketi start --app-id $APP_ID --app-key $APP_KEY --app-secret $APP_SECRET --port 6001 --debug
Restart=always
User=forge
Group=www-data
Environment=PATH=/usr/bin:/usr/local/bin
Environment=NODE_ENV=production
WorkingDirectory=/home/forge/<mydomain>.com

[Install]
WantedBy=multi-user.target

This is soketi.env which is in /home/forge/.com

APP_ID=<app-id>
APP_KEY=<key>
APP_SECRET=<secret>
SOKETI_SSL_CERT=/etc/nginx/ssl/<path>/server.crt
SOKETI_SSL_KEY=/etc/nginx/ssl/<path>/server.key
SOKETI_SSL_CA=/etc/nginx/ss/l<path>/server.crt

And I have the same variables in the .env file

There's no combo of this that's working.

I made sure to add both 6000 and 6001 to the firewall exceptions, but I keep getting responses like this

HTTP/1.1 101 Switching Protocols
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Accept: s3pPLMBiTxaQ9kYGzzhZRbK+xOo=
uWebSockets: 20

�r{"event":"pusher:error","data":{"code":4001,"message":"App key <key> does not exist."}}

Or I get 502 errors.

I have no idea what else to try

Thanks