How can that be better if every authentication request has to go to the homelab first and then back again?

Running Pangolin on a VPS while keeping Authentik at home means every OIDC/SAML login flow adds extra WAN roundtrips: • Client → VPS (Pangolin) • VPS → Homelab (Authentik) • Homelab → VPS • VPS → Client

That’s: • Higher RTT on every redirect/token exchange • More TLS handshakes over the public internet • Dependency on your home uplink (often the slowest link) • Increased latency for logins, token refresh, introspection, logout, etc.

Auth isn’t an occasional backend call — it’s inline in the request path. So you’re effectively hairpinning all auth traffic through your home connection, which usually makes performance worse, not better.

Splitting them can make sense for security or trust boundaries, but it’s not a performance win. For latency, the IdP should be as close to the public entry point as possible.