fix: oidc with authentik not working

config/runtime.exs

@@ -112,12 +112,20 @@ if config_env() == :prod do
     You can generate one by calling: mix phx.gen.secret
     """)
 
-  host = System.get_env("PHX_HOST") || raise "Please define the PHX_HOST environment variable."
+  # PHX_HOST or DOMAIN can be used to set the host for the application.
+  # DOMAIN is commonly used in deployment environments (e.g., Portainer templates).
+  host =
+    System.get_env("PHX_HOST") ||
+      System.get_env("DOMAIN") ||
+      raise "Please define the PHX_HOST or DOMAIN environment variable."
   port = String.to_integer(System.get_env("PORT") || "4000")
 
   config :mv, :dns_cluster_query, System.get_env("DNS_CLUSTER_QUERY")
 
-  # Rauthy OIDC configuration
+  # OIDC configuration (works with any OIDC provider: Authentik, Rauthy, Keycloak, etc.)
+  # Note: The strategy is named :rauthy internally, but works with any OIDC provider.
+  # The redirect_uri callback path is always /auth/user/rauthy/callback regardless of provider.
+  #
   # Supports OIDC_CLIENT_SECRET or OIDC_CLIENT_SECRET_FILE for Docker secrets.
   # OIDC_CLIENT_SECRET is required only if OIDC is being used (indicated by explicit OIDC env vars).
   oidc_base_url = System.get_env("OIDC_BASE_URL")
@@ -134,12 +142,15 @@ if config_env() == :prod do
       get_env_or_file.("OIDC_CLIENT_SECRET", nil)
     end
 
+  # Build redirect_uri: use OIDC_REDIRECT_URI if set, otherwise build from host.
+  # Uses HTTPS since production runs behind TLS termination.
+  default_redirect_uri = "https://#{host}/auth/user/rauthy/callback"
+
   config :mv, :rauthy,
     client_id: oidc_client_id || "mv",
     base_url: oidc_base_url || "http://localhost:8080/auth/v1",
     client_secret: client_secret,
-    redirect_uri:
-      System.get_env("OIDC_REDIRECT_URI") || "http://#{host}:#{port}/auth/user/rauthy/callback"
+    redirect_uri: System.get_env("OIDC_REDIRECT_URI") || default_redirect_uri
 
   # Token signing secret from environment variable
   # This overrides the placeholder value set in prod.exs