Redirect Loop on Proxy Auth for Homeassistant

Hello everyone,

I'm struggling on setting up authentication through authentik for homeassistant.

I've configured Authentik and Home Assistant according to the manuel: https://docs.goauthentik.io/integrations/services/home-assistant/

When I access homeassistant.public.domain i get redirected to authentik. After authenticating there I get into a redirect loop.
The URL looks like this:
https://auth.public.domain/if/flow/default-provider-authorization-explicit-consent/?client_id=EMeLuBu9zfN9Lao20TBf3qXwoM9iCfnwOovuhgrR&redirect_uri=https%3A%2F%2Fhomeassistant.public.domain%2Foutpost.goauthentik.io%2Fcallback%3FX-authentik-auth-callback%3Dtrue&response_type=code&scope=profile+openid+email+ak_proxy&state=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnb2F1dGhlbnRpay5pby9vdXRwb3N0L0VNZUx1QnU5emZOOUxhbzIwVEJmM3FYd29NOWlDZm53T292dWhnclIiLCJzaWQiOiJGSkNUNk5ZUUYzS1I3VlFFWTJJNEpDQ0RXU0VNV09IUVo3T1NXREFTVVJZWVEyWFJYRk9aQkFNUlRHQTJSMkZDMkQ0V1lZT0pNVVIySklHNTZHV01FMkRPUzNCRUszNzZMVzdDNk1ZIiwic3RhdGUiOiJIYXlLZ0NMQWwydHR3SEtLdDhSZXRwaDQ2MjEteHl0MFlfZlBKTzF6LXcwIiwicmVkaXJlY3QiOiJodHRwczovL2hvbWVhc3Npc3RhbnQua29yYi5zeXN0ZW1zL2xvdmVsYWNlIn0.CtuLYz05pjPyvNTvct31jz73MZRUGIgJZ8i9FrbFWeU

This is my nginx config:

```
# Upgrade WebSocket if requested, otherwise use keepalive
map $http_upgrade $connection_upgrade_keepalive {
default upgrade;
'' '';
}

################## upstream config ####################

upstream homeassistant_public_domain {
server akohome01.home.public.domain:8123;
# Improve performance by keeping some connections alive.
keepalive 10;
}

################### server config #####################

server {
# HTTP server config
listen 80;
server_name _;

# 301 redirect to HTTPS
return 301 https://$host$request_uri;
}

server {
# SSL and VHost configuration
listen 443 ssl;
http2 on;
server_name _;

access_log /var/log/nginx/access_homeassistant.log combined;
error_log /var/log/nginx/error_homeassistant.log warn;

ssl_certificate /etc/letsencrypt/live/public.domain/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/public.domain/privkey.pem;

# Increase buffer size for large headers
# This is needed only if you get 'upstream sent too big header while reading response
# header from upstream' error when trying to access an application protected by goauthentik
proxy_buffers 8 16k;
proxy_buffer_size 32k;

location / {
# Put your proxy_pass to your application here, and all the other statements you'll need
proxy_pass http://homeassistant_public_domain;
# proxy_set_header Host $host;
# proxy_set_header ...
# Support for websocket
proxy_http_version 1.1;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade_keepalive;

##############################
# authentik-specific config
##############################
auth_request /outpost.goauthentik.io/auth/nginx;
error_page 401 = @goauthentik_proxy_signin;
auth_request_set $auth_cookie $upstream_http_set_cookie;
add_header Set-Cookie $auth_cookie;

# translate headers from the outposts back to the actual upstream
auth_request_set $authentik_username $upstream_http_x_authentik_username;
auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
auth_request_set $authentik_email $upstream_http_x_authentik_email;
auth_request_set $authentik_name $upstream_http_x_authentik_name;
auth_request_set $authentik_uid $upstream_http_x_authentik_uid;

proxy_set_header X-authentik-username $authentik_username;
proxy_set_header X-authentik-groups $authentik_groups;
proxy_set_header X-authentik-email $authentik_email;
proxy_set_header X-authentik-name $authentik_name;
proxy_set_header X-authentik-uid $authentik_uid;
}

# all requests to /outpost.goauthentik.io must be accessible without authentication
location /outpost.goauthentik.io {
# When using the embedded outpost, use:
proxy_pass http://akoauth01.home.public.domain:9000/outpost.goauthentik.io;
# For manual outpost deployments:
# proxy_pass http://outpost.company:9000;

# Note: ensure the Host header matches your external authentik URL:
proxy_set_header Host $host;

proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
add_header Set-Cookie $auth_cookie;
auth_request_set $auth_cookie $upstream_http_set_cookie;
proxy_pass_request_body off;
proxy_set_header Content-Length "";
}

# Special location for when the /auth endpoint returns a 401,
# redirect to the /start URL which initiates SSO
location @goauthentik_proxy_signin {
internal;
add_header Set-Cookie $auth_cookie;
return 302 /outpost.goauthentik.io/start?rd=$request_uri;
# For domain level, use the below error_page to redirect to your authentik server with the full redirect path
# return 302 https://authentik.company/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
}
}
```

Im running authentik [2024.6.1](https://goauthentik.io/docs/releases/2024.6) via docker-compose with the integrated outpost

Anyone got an idea?