From 3f134094140d8869e6362ccf445340ce4ceef2b0 Mon Sep 17 00:00:00 2001
From: Nathan <nathan@castaldifamily.com>
Date: Sun, 14 Jun 2026 08:34:15 -0400
Subject: [PATCH] fix: use internal Authentik host for outpost containers

- Change AUTHENTIK_HOST from https://sso.castaldifamily.com to http://authentik_server:9000
- Fixes hairpin NAT issue preventing outposts from connecting to Authentik
- Affects prowlarr, radarr, sonarr, and sabnzbd outpost containers
---
 nodes/heimdall/prowlarr/compose.yaml | 2 +-
 nodes/heimdall/radarr/compose.yaml   | 2 +-
 nodes/heimdall/sabnzbd/compose.yaml  | 2 +-
 nodes/heimdall/sonarr/compose.yaml   | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/nodes/heimdall/prowlarr/compose.yaml b/nodes/heimdall/prowlarr/compose.yaml
index cc20257..e8f9a12 100644
--- a/nodes/heimdall/prowlarr/compose.yaml
+++ b/nodes/heimdall/prowlarr/compose.yaml
@@ -31,7 +31,7 @@ services:
     networks:
       - proxy-net
     environment:
-      AUTHENTIK_HOST: https://sso.castaldifamily.com
+      AUTHENTIK_HOST: http://authentik_server:9000
       AUTHENTIK_TOKEN: 42FCcV9gmTfixaak77xW4eAZIMUUJ0u5vGsxvumfo1Lav5DIyLViDz4xqinE
       AUTHENTIK_INSECURE: "false"
     labels:
diff --git a/nodes/heimdall/radarr/compose.yaml b/nodes/heimdall/radarr/compose.yaml
index 13f67f8..64d506c 100644
--- a/nodes/heimdall/radarr/compose.yaml
+++ b/nodes/heimdall/radarr/compose.yaml
@@ -40,7 +40,7 @@ services:
     networks:
       - proxy-net
     environment:
-      AUTHENTIK_HOST: https://sso.castaldifamily.com
+      AUTHENTIK_HOST: http://authentik_server:9000
       AUTHENTIK_TOKEN: mEK1nIhle1dorsb2x7EJlDfwqdQ2GZLlDdzZhTeP9RMvrWtrlM0ZW89SiBWB
       AUTHENTIK_INSECURE: "false"
     labels:
diff --git a/nodes/heimdall/sabnzbd/compose.yaml b/nodes/heimdall/sabnzbd/compose.yaml
index a9bc2fb..33f68ca 100644
--- a/nodes/heimdall/sabnzbd/compose.yaml
+++ b/nodes/heimdall/sabnzbd/compose.yaml
@@ -40,7 +40,7 @@ services:
     networks:
       - proxy-net
     environment:
-      AUTHENTIK_HOST: https://sso.castaldifamily.com
+      AUTHENTIK_HOST: http://authentik_server:9000
       AUTHENTIK_TOKEN: xvPTq2ASWspkW9Z7H44RPwLZ9LhFqBrtQ11eXPlE7QWGhsixWU7Rc07xVmsw
       AUTHENTIK_INSECURE: "false"
     labels:
diff --git a/nodes/heimdall/sonarr/compose.yaml b/nodes/heimdall/sonarr/compose.yaml
index 9e7aff9..6f70c34 100644
--- a/nodes/heimdall/sonarr/compose.yaml
+++ b/nodes/heimdall/sonarr/compose.yaml
@@ -42,7 +42,7 @@ services:
       - proxy-net
     container_name: sonarr_outpost
     environment:
-        AUTHENTIK_HOST: https://sso.castaldifamily.com
+        AUTHENTIK_HOST: http://authentik_server:9000
         AUTHENTIK_INSECURE: "false"
         AUTHENTIK_TOKEN: cJ4UWeFQ2DUTyvR22s588ciFuLSw698HTVxnEf7ecN3dq3nFOyVod6ngE66Z
         # Optional setting to be used when `authentik_host` for internal communication doesn't match the public URL.