thread_id: 01a046ba-1301-72c1-8d9f-347ba1c28cf7
updated_at: 1787952056

Authentik SSO + Anubis bot-protection chain debugging on homelab (Caddy → Anubis → Authentik outpost → apps). Key discovery: CLI curl probes of the auth chain return 200 from Anubis's JS challenge page, not from the outpost — making CLI verification of forward_auth fundamentally limited. External login broken: after passing Anubis externally, user hits Authentik's unstyled 'Not Found' page (outpost 404), indicating provider host-match failure for external requests.