If you end up going with conduit, I would instead use conduwuit. More development effort and better docs IMO. I think maybe even one of the main devs from conduit moved over to conduwuit? But not 100% sure
https://conduwuit.puppyirl.gay/
The domain choice? Eh, not what I would have gone with but to each their own lol
That’s… not how that works. Just because they’re getting separate IP addresses doesn’t mean you can all of the sudden have “full control” and start using privileged ports without granting that sys capability to docker. I fear you are overcomplicating what should be a fairly straightforward process and likely weakening security because you don’t fully grok the implications of the security measures you’re attempting to put in place. Just use traefik or caddy and be done with it.
This is the way. I just hope they don’t start gatekeeping essential features behind the “enterprise” license. Already they have announced push-based 2fa (like Duo) will be enterprise which is a bit of a bummer but it’s honestly awesome software otherwise and beggars can’t be choosers!
This is typically the case. Increasingly, self-hosted apps use integrated OIDC or OAuth but for those that don’t there are various other methods of integration into the SSO provider you’re using including forward auth and remote username. Authentik is nice in that it is also a forward-auth proxy and so you don’t need to use an additional oauth proxy software like oauth2-proxy.
I’m pretty sure it’s a lot easier than all of that. Account settings -> oauth -> link to oauth. That’s it. Maybe gets more complicated but sounds like that should be it for your use case.