honestly its been months, i found unstaged changes and forgot

roles/authentik_proxy/upstream/SOURCE.md

@@ -1,7 +1,13 @@
 # Upstream Snapshot
 
-This directory stores copied upstream reference files for the `authentik_proxy` role.
+Role: `authentik_proxy`
+Snapshot source inventory: `docs/upstream-sources.yml`
+Snapshot status: `tracked`
 
-See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+Fetched repositories:
+- application README `README.md`: copied
+- application Compose URL `https://docs.goauthentik.io/add-secure-apps/outposts/manual-deploy-docker-compose/`: invalid (response is not Compose-shaped YAML)
+README Compose candidates: 0
+Ambiguous README files: 0
 
-Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.
+These files are reference snapshots only. Deployments are generated from role templates.

roles/authentik_proxy/upstream/docker-compose.override.yml

@@ -0,0 +1,17 @@
+services:
+  authentik_proxy:
+    container_name: authentik-proxy-outpost
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:latest
+    restart: unless-stopped
+    # Optionally specify the container's network, which must be able to reach the core authentik server.
+    # networks:
+    #   - foo
+    ports:
+      - 9000:9000
+      - 9443:9443
+    environment:
+      AUTHENTIK_HOST: https://example.com
+      AUTHENTIK_INSECURE: "false"
+      AUTHENTIK_TOKEN: 
+      # Optional setting to be used when `authentik_host` for internal communication doesn't match the public URL.
+      # AUTHENTIK_HOST_BROWSER: https://external-domain.tld