OIDC does not work with CGNAT IP

[mitchplze]

Good morning. Looking forward to trying this app out. Having issues with OIDC configuration.

No matter what I put for ALLOWED_HOSTS=, I keep getting this error.

My Pocket ID instance is definitely reachable, but only over CGNat (Tailscale).

windshift-1  | 2026-07-31T16:37:02.745041510Z 2026/07/31 16:37:02 ERRO OIDC test connection failed component=sso provider_id=1
windshift-1  | 2026-07-31T16:37:02.745123618Z   error=
windshift-1  | 2026-07-31T16:37:02.745126840Z   │ OIDC discovery failed: OpenID Provider Configuration Discovery has failed
windshift-1  | 2026-07-31T16:37:02.745130192Z   │ Get "https://id.mydomain.ca/.well-known/openid-configuration": dial tcp 100.97.100.76:443: dial host resolves to a blocked IP range: 100.97.100.76 (tcp4)

For issuer URL, I've tried: https://id.mydomain.ca and https://id.mydomain.ca/.well-known/openid-configuration and https://id.mydomain.ca/authorize

Currently using:

environment:
      - BASE_URL=https://wind.mydomain.ca
      - DOMAIN=wind.mydomain.ca
      - SSO_SECRET=${SSO_SECRET}
      - DB_PATH=/data/windshift.db
      - ATTACHMENT_PATH=/data/attachments
      - USE_PROXY=true
      - ALLOWED_HOSTS=*.mydomain.ca ### i've also tried id.mydomain.ca and *

Also a tiny UI issue:

The client secret field always shows in the UI as "Not configured", even when it is.

[mitchplze]

Seems like ALLOW_LOCAL_CONNECTIONS=true may have gotten this working

[stefan-ernst]

Yes, this is part of the SSRF protection. But it probably makes sense to enable this by default with the next release

[stefan-ernst]

0.8.4 is now defaulting to allow local connections. You can keep the env var as is