Error in OAuth discovery: TypeError: fetch failed. With authentik on public domain exposed via traefik with cloudflare certificates

[Alfariy20]

OAuth login dont redirects me to authentik and gives this error: Error in OAuth discovery: TypeError: fetch failed. This error implies, that immich doesnt have access to authentik issuer. On lan network OAuth working perfectly fine with no issues, and redirects me to http://172.16.1.222:9000 (ip of authentik) and than logins me to immich on ip http://172.16.1.222:2083. But when i move authentik and immich behind traefik reverse proxy and expose this services with trusted cloudflare certificates, OAuth suddenly stops working with same config. I think this is certificates issue, but i dont know how to fix it.
My compose.yml:

name: immich

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    # extends:
    #   file: hwaccel.transcoding.yml
    #   service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
    volumes:
      # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
      - ${UPLOAD_LOCATION}:/data
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - .env
    ports:
      - '2283:2283'
    depends_on:
      - redis
      - database
    restart: always
    healthcheck:
      disable: false
    networks:
      - frontend
      - backend
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.immich.entrypoints=http"
      - "traefik.http.routers.immich.rule=Host(`immich.MYDOMAIN.com`)"
      - "traefik.http.middlewares.immich-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.immich.middlewares=immich-https-redirect"
      - "traefik.http.routers.immich-secure.entrypoints=https"
      - "traefik.http.routers.immich-secure.rule=Host(`immich.MYDOMAIN.com`)"
      - "traefik.http.routers.immich-secure.tls=true"
      - "traefik.http.routers.immich-secure.tls.certresolver=cloudflare"
      - "traefik.http.routers.immich-secure.service=immich"
      - "traefik.http.services.immich.loadbalancer.server.port=2283"
      - "traefik.docker.network=frontend"    

  immich-machine-learning:
    container_name: immich_machine_learning
    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    # extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration
    #   file: hwaccel.ml.yml
    #   service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
    volumes:
      - model-cache:/cache
    env_file:
      - .env
    restart: always
    healthcheck:
      disable: false
    networks:
      - backend

  redis:
    container_name: immich_redis
    image: docker.io/valkey/valkey:9@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
    healthcheck:
      test: redis-cli ping || exit 1
    restart: always
    networks:
      - backend

  database:
    container_name: immich_postgres
    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
      # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
      # DB_STORAGE_TYPE: 'HDD'
    volumes:
      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    shm_size: 128mb
    restart: always
    healthcheck:
      disable: false
    networks:
      - backend

volumes:
  model-cache:
networks:
  frontend:
    external: true
  backend:
    external: true

MYDOMAIN.com - is domain with valid DNS setup. Proxmox OAuth with authentik on this domain works, but immich doesn`t.
frontend - docker network with internet access.
backend - docker network without internet access.
My .env:

# You can find documentation for all the supported env variables at https://docs.immich.app/install/environment-variables

# The location where your uploaded files are stored
UPLOAD_LOCATION=/home/alfariy/filegarbage/immich/

# The location where your database files are stored. Network shares are not supported for the database
DB_DATA_LOCATION=./postgres

# To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
TZ=Europe/Moscow

# The Immich version to use. You can pin this to a specific version like "v2.1.0"
IMMICH_VERSION=v2

# Connection secret for postgres. You should change it to a random password
# Please use only the characters `A-Za-z0-9`, without special characters or spaces
DB_PASSWORD=validdbpassword
# The values below this line do not need to be changed
###################################################################################
DB_USERNAME=postgres
DB_DATABASE_NAME=immich

My traefik.yaml:

api:
  dashboard: true
  debug: true
entryPoints:
  http:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: https
          scheme: https
  https:
    address: ":443"
serversTransport:
  insecureSkipVerify: true
providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
  file:
    watch: true
    directory: /dynamic/
certificatesResolvers:
  cloudflare:
    acme:
      email: validcloudflareemail
      storage: /acme.json
      dnsChallenge:
        provider: cloudflare
        # provider: vultr
        resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"

log:
  level: "INFO"
  filePath: "/var/log/traefik/traefik.log"
accessLog:
  filePath: "/var/log/traefik/access.log"

Immich logs, related to error:

[Nest] 29  - 06/16/2026, 9:13:10 PM   ERROR [Api:OAuthRepository~36f4xgrd] Error in OAuth discovery: TypeError: fetch failed
[Nest] 29  - 06/16/2026, 9:13:10 PM   ERROR [Api:OAuthRepository~36f4xgrd] TypeError: fetch failed

When I open authentik application and press test "Check access" it shows me that authentik can access to immich, but immich don`t redirect to authentik and give error.
Immich OAuth settings:

issuer url: https://authentik.MYDOMAIN.com/application/o/immich/
client id: validclientid
clientsecret: validclientsecret
token_endpoint_auth_method: client_secret_post
scope: openid email profile
id_token_signed_response_alg: RS256
userinfo_signed_response_alg: none

Please help me resolve this issue (and sorry for my english, I am not native speaker)

[Alfariy20]

I tried to recreate authentik provider and application from zero with my domain instead of ip, and it gives the same error