The outpost upstream was being passed directly to Caddy's dial field with the full URL (http://host:port), but Caddy expects just host:port. This was causing DNS lookup errors with a leading slash (/authentik.bologna.local.fuo.fi). Now properly parses the URL to extract just the hostname and port.