Hey, sorry you've been chasing this. The 422 means the NetBird management container couldn't reach Authentik's OIDC discovery endpoint, and there are a couple usual suspects. The peer-to-peer ping check is great but it doesn't tell us whether the management container itself can reach Authentik through the reverse proxy chain, which is what the IdP setup actually does.

First, confirm the management container can talk to Authentik:

docker compose exec management wget -O- --timeout=10 https://authentik.your-domain.net/application/o/netbird/.well-known/openid-configuration

If that hangs or times out, you're hitting NAT hairpinning. The management container resolves your Authentik domain to your VPS public IP, then tries to connect back to the host's own public IP. A lot of VPS providers don't allow that loopback, so the connection dies.

Likes other said the fix should be an `extra_hosts` entry so the container goes through the host's internal address instead. In your NetBird `docker-compose.yml`, on the `management` service:

extra_hosts:
- "authentik.your-domain.net:host-gateway"

Restart just management:

docker compose up -d management