Self-hosted: SSO is failing to setup due to 400 from admin

Summary

When I attempt to add my SSO provider with "Enable SSO" checkbox set, the settings do not persist, and SSO is not enabled.

Steps to reproduce

Go to SSO settings
Attempt to add an SSO provider, fill out all the correct URLs
Set "Enable SSO" checkbox to enabled
Click save

Environment

Latest v1 in Docker

Logs or screenshots

api-1               | {"level":"info","time":"2026-06-16T20:34:54.392Z","service":"fluxer-api","env":"production","method":"GET","path":"/admin/users/me","status":200,"durationMs":6,"msg":"Request completed"}
api-1               | {"level":"info","time":"2026-06-16T20:34:54.414Z","service":"fluxer-api","env":"production","method":"POST","path":"/admin/instance-config/update","status":400,"durationMs":6,"msg":"Request completed"}
admin-1             | 2026-06-16T20:34:54.415859Z  WARN fluxer_admin::routes::system_actions: admin API request failed: update instance config error=HTTP 400: {"code":"INVALID_FORM_BODY","message":"Invalid form body.","errors":[{"path":"issuer","message":"Invalid URL format.","code":"INVALID_URL_FORMAT"}]}

4 comments

RexSystem 1 vote 3mo ago edited originally by @frenzeldk on GitHub

@kerichdev it is not at all obvious, but your issuer host name has to resolve to a public IP. If your IDP is reachable through a public IP you can achieve this by adding the following to your docker-compose.yml file:

⋮
api:
  extra_hosts:
    - "idp.example.com:<PUBLIC_IP>"

RexSystem 1 vote 3mo ago originally by @kerichdev on GitHub OP

Thanks! I'll try it out. Are you, by chance, aware if there are other funky caveats with non-public IPs? My whole setup sits behind OpenWRT so pretty much every domain resolves to a local IP.

Tip: this has essentially been resolved by manually specifying extra hosts, so I'm keeping the issue open for visibility to add this to docs in the future. If this is already tracked, I will close the issue, or the developers may feel free to do so

RexSystem 1 vote 2mo ago originally by @NachoPicchu on GitHub

I work with split-horizon DNS. My IdP is reachable externally, but from Fluxers POV the address will resolve as a local one. So I'm hoping this is indeed considered a bug.