The OIDC callback answers with the session cookies (encrypted tokens), which don't fit nginx's default 4k response-header buffer.
One nginx owns host ports 80/443 for every project (Gitea, Musify) and proxies by container name over infra-net and gitea_gitea; a certbot service renews the Let's Encrypt certificates.
Admin