Need help with Brands

[begunfx]

So I setup my first application (gethomepage.dev) successfully (I believe). But when I try to apply a custom brand I always get the default. I setup authentik via docker compose and am using NGINX Proxy Manager to forward traffic from home.mydomain.com (homepage proxy) to hostname:9000 (authentik).

Note: I am using Proxy and not forwarding auth in the Provider.

I did notice if I create a brand for auth.mydomain.com it does seem to update. It seems that when I select home.mydomain.com it redirects to auth.mydomain.com. Perhaps I'm misunderstanding how authentikk handles proxy requests from NGINX Proxy Manager.

This is my compose file for authentic (note env variables were loaded into Portainer and referenced below)

services:
  postgresql:
    image: docker.io/library/postgres:16-alpine
    container_name: authentik-postgres
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 5s
    volumes:
      # Pointing directly to the desired host path for database data
      - /volume1/docker/authentik/database:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
      POSTGRES_USER: ${PG_USER:-authentik}
      POSTGRES_DB: ${PG_DB:-authentik}
    # Removed env_file as per request
  redis:
    image: docker.io/library/redis:alpine
    container_name: authentik-redis
    command: --save 60 1 --loglevel warning
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 3s
    volumes:
      # Pointing directly to the desired host path for redis data
      - /volume1/docker/authentik/redis:/data
  server:
    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.6.2}
    container_name: authentik-server
    restart: unless-stopped
    command: server
    environment:
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
    volumes:
      # Pointing to specific subdirectories under the main authentik volume
      - /volume1/docker/authentik/media:/media
      - /volume1/docker/authentik/custom-templates:/templates
    # Removed env_file as per request
    ports:
      - "${COMPOSE_PORT_HTTP:-9000}:9000"
      - "${COMPOSE_PORT_HTTPS:-9443}:9443"
    depends_on:
      postgresql:
        condition: service_healthy
      redis:
        condition: service_healthy
  worker:
    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.6.2}
    container_name: authentik-worker
    restart: unless-stopped
    command: worker
    environment:
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
    user: root
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      # Pointing to specific subdirectories under the main authentik volume
      - /volume1/docker/authentik/media:/media
      - /volume1/docker/authentik/certs:/certs
      - /volume1/docker/authentik/custom-templates:/templates
    # Removed env_file as per request
    depends_on:
      postgresql:
        condition: service_healthy
      redis:
        condition: service_healthy

This is what I did:
Provider:
Name: Homepage
Authorization Flow: default -implicit-concent
Proxy
External host: https://home.mydomain.com (proxy host for homepage)
Internal host: http://hostname:3550

Application:
name: homepage
slug: homepage
Provider: Homepage
Policy engine mode: all

Outposts:
authentic Embedded Outpost:
Type: Proxy
Integration: none
Applications: homepage
Advanced settings:
authentik_host: https://auth.mydomain.com (proxy host for authentic)
authentik_host_browser: https://auth.mydomain.com (proxy host for authentic)
No other setting touched

Brands:
Domain: home.mydomain.com
Branding settings:
Title: homepage
Logo: /media/homepage_logo.png
No other items set.

Not sure what I'm missing. I thought It had something to do with the way the request was sent from NGINX to authentik so I played with the advanced settings in NGINIX but no difference. Any help would be greatly appreciated!

[begunfx]

So after some research I think the issue is my confusion with how authentic works with different sub-domains. I guess I had assumed that the brand would be based on the referring sub-domain but it seems that unless I setup multi-tenancy with additional auth sessions then all my apps will redirect to the single auth.mydomain.com so I guess I need to focus on styling that page. Anyone feel free to correct me if I am still getting it wrong. Thanks.