solved... i just needed a little redirection. I had copied a directive from elsewhere in my configs which enforced a strict IP whitelist. but, I'd overlooked it.