Building on arm64 Mac without GOOS/GOARCH produced amd64 node "exec format error". The homelab CA was only trusted in the build stage, so the final distroless runtime couldn't verify Authentik's TLS cert during OIDC discovery.
Multi-stage build (golang:1.26 -> distroless/static-nonroot), CGO disabled, GOPRIVATE set for the kmsvc-proto module fetch.
riotpiaole