Private traefik middleware to work with remote authentik server behind another traefik

**Describe your question/**
What I want to achieve seems rather simple, but after numerous tries of different configurations I am a bit lost on how it should work. The goal is to have traefik on my home server protect some services with traefik forwardAuth. In the authentik server I would like to use a Forward Auth (domain level) provider for all simple services I have on my home server. This must result in each application only needing to have a single additional traefik label, e.g.:
- "traefik.http.routers.${SERVICE}.middlewares=authentik-auth@docker"

**Relevant info**
Home server:
**proxy**: traefik
**deployment**: docker compose
**domain**: *.private.domain.tld
**example service**: whoami.private.domain.tld

Public server:
**proxy**: traefik
**deployment**: docker compose
**domain**: *.domain.tld
runs authentik server

**Additional context**
I tried several configurations options. To start with the outpost, in the expectation that this would handle all local authentications, but didn't got this to work properly.

I ended, for today, with having the Home server traefik configured like this:
```
- "traefik.http.middlewares.authentik-auth.forwardAuth.address=https://auth.domain.tld/outpost.goauthentik.io/auth/traefik"
- "traefik.http.middlewares.authentik-auth.forwardauth.trustForwardHeader=true"
- "traefik.http.middlewares.authentik-auth.forwardauth.authResponseHeaders=Set-Cookie,Authorization,X-Forwarded-User,X-authentik-username,X-authentik-groups,X-authentik-entitlements,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version
```
But this doesn't result in getting redirect back to the original service (whoami.private.domain.tld). It isn't possible and even not desirable to have traefik on the home server connect directly to the authentik server. On the public server traefik will always be in between.

How can I get this to work, without the need of specific configurations for each service I run on the home server?

No repository file, test, or code entry point is identified. Start by comparing the home and public Docker Compose Traefik configurations and the shown ForwardAuth settings; done means a protected home service redirects through the remote Authentik server and returns to the original service without per-service configuration.

Written by the indexing model from the issue text.