Support separate URLs for server/client side connection to Kratos

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe your problem

In a self-hosted environment with limited outbound connectivity, it may not be possible for the login (NextJS) server to communicate with Kratos via the public internal URL. Currently the env (NEXT_PUBLIC_)ORY_SDK_URL affects both the server- and client-side connections.

Describe your ideal solution

I would like to be able to specify a public URL https://example.com so that the browser can connect to Kratos public endpoints at https://example.com/self-service/... etc., and also an "internal" URL http://kratos-public that the NextJS server app can use to make connections directly within the same internal network.

Workarounds or alternatives

I have tried setting the external URL in the ory.config.ts file to the public URL and passing the private URL to the server with ORY_SDK_URL, but the browser still ends up redirecting the user to the private URL, which is unreachable.

Version

@ory/nextjs/1.0.0-rc.1

Additional Context

No response

Start by inspecting the @ory/nextjs configuration and every use of ORY_SDK_URL, then trace how server requests and browser redirects are configured. Done means the server can use an internal Kratos URL while the browser uses the public URL for self-service endpoints, without redirecting to the internal address.