fix: oidc with authentik not working

README.md

@@ -45,7 +45,7 @@ Our philosophy: **software should help people spend less time on administration
 - 🚧 Sorting & filtering  
 - 🚧 Roles & permissions (e.g. board, treasurer)  
 - ✅ Custom fields (flexible per club needs)  
-- ✅ SSO via OIDC (tested with Rauthy)  
+- ✅ SSO via OIDC (works with Authentik, Rauthy, Keycloak, etc.)  
 - 🚧 Self-service & online application  
 - 🚧 Accessibility, GDPR, usability improvements  
 - 🚧 Email sending  
@@ -147,7 +147,26 @@ Mila uses OIDC for Single Sign-On. In development, a local **Rauthy** instance i
 5. copy client secret to `.env` file
 6. abort and run `just run` again
 
-Now you can log in to Mila via OIDC!  
+Now you can log in to Mila via OIDC!
+
+### OIDC with other providers (Authentik, Keycloak, etc.)
+
+Mila works with any OIDC-compliant provider. The internal strategy is named `:rauthy`, but this is just a name — it works with any provider.
+
+**Important:** The redirect URI must always end with `/auth/user/rauthy/callback`.
+
+Example for Authentik:
+1. Create an OAuth2/OpenID Provider in Authentik
+2. Set the redirect URI to: `https://your-domain.com/auth/user/rauthy/callback`
+3. Configure environment variables:
+   ```bash
+   DOMAIN=your-domain.com                    # or PHX_HOST=your-domain.com
+   OIDC_CLIENT_ID=your-client-id
+   OIDC_BASE_URL=https://auth.example.com/application/o/your-app
+   OIDC_CLIENT_SECRET=your-client-secret     # or use OIDC_CLIENT_SECRET_FILE
+   ```
+
+The `OIDC_REDIRECT_URI` is auto-generated as `https://{DOMAIN}/auth/user/rauthy/callback` if not explicitly set.  
 
 ## ⚙️ Configuration
 
@@ -210,13 +229,13 @@ For testing the production Docker build locally:
    # Required variables:
    SECRET_KEY_BASE=<your-generated-secret>
    TOKEN_SIGNING_SECRET=<your-generated-secret>
-   PHX_HOST=localhost
+   DOMAIN=localhost                          # or PHX_HOST=localhost
    
-   # Optional (have defaults in docker-compose.prod.yml):
+   # Optional OIDC configuration:
    # OIDC_CLIENT_ID=mv
    # OIDC_BASE_URL=http://localhost:8080/auth/v1
-   # OIDC_REDIRECT_URI=http://localhost:4001/auth/user/rauthy/callback
-   # OIDC_CLIENT_SECRET=<from-rauthy-client>
+   # OIDC_CLIENT_SECRET=<from-your-oidc-provider>
+   # OIDC_REDIRECT_URI is auto-generated as https://{DOMAIN}/auth/user/rauthy/callback
    
    # Alternative: Use _FILE variables for Docker secrets (takes priority over regular vars):
    # SECRET_KEY_BASE_FILE=/run/secrets/secret_key_base