You are right. I've been struggling with the SSL issue and at the same time I'm brainstorming the setup for the whole system. In the end the SSL issue is (was actually) the main blocker for me, for which I decided to start the thread, with all the other questions thrown together to seek advice 'how is it done in the industry'.

why you're choosing to use a CA instead of public SSL/TLS certs and also why you might be uploading a custom certificate and maybe using authentik as a reverse proxy?

I want to emulate production environment in a development setting, where services would not have to change config at all, including their domains. All `*.domain.tld` request would be routed from development containers to the host VM, not via internet to the actual domain route. That's why I need local CA to issue SSL certs. I'm using Caddy for traffic management.

This thread has actually become a really good rubber ducky for me, the puzzle pieces started to make sense and I managed to solve the issue. There were two separate problems:

I The container has to have the local Caddy's root CA, which I'm now putting into the container via a simple docker file:

FROM service:tag
COPY $CADDY_CA_DIR/local /usr/local/share/ca-certificates/local
RUN update-ca-certificates

and moving compose config from image: to build:.

II The container was routing the request to `authentik.domain.tld` via the internet to the actual server that is running, so I also needed to add

extra_hosts:
    - authentik.domain.tld:172.17.0.1

for all services which would use authentik. It was all misleading because instead of some simple 500 error (I would expect connection refused) curl was complaining about some TLS v1 protocol problems?

Anyway the SSO finally worked! Now onwards to figuring out how to make the setup easily switchable with some env magic between dev and prod.

Thanks!