Thanks for this, would you be able to share the configuration you used to get this working? I've set up a new clean instance of Grist and still can't get his working so I must be missing something.

services:
grist:
ports:
- 8484:8484
volumes:
- path/to/grist:/persist
environment:
- GRIST_SESSION_SECRET=********
- GRIST_DEFAULT_EMAIL=********
- GRIST_SANDBOX_FLAVOR=gvisor
- GRIST_OIDC_IDP_ISSUER=https://auth.DOMAIN.com/oidc
- GRIST_OIDC_IDP_CLIENT_ID=grist
- GRIST_OIDC_IDP_CLIENT_SECRET=**********
- APP_HOME_URL=https://grist.DOMAIN.com
- GRIST_OIDC_SP_IGNORE_EMAIL_VERIFIED=true
- GRIST_ANON_PLAYGROUND=false
- GRIST_LOG_AS_JSON=true
- GRIST_TELEMETRY_LEVEL=full
- GRIST_OPEN_GRAPH_PREVIEW_IMAGE=image.png
stdin_open: true
tty: true
image: gristlabs/grist
restart: unless-stopped
labels:
caddy: grist.DOMAIN.com
caddy.reverse_proxy: "{{upstreams 8484}}"
networks:
- caddy_net
networks:
caddy_net:
external: true
name: caddy_net

voidauth:
image: voidauth/voidauth:latest
restart: unless-stopped
volumes:
- /opt/appdata/voidauth/config:/app/config
- /opt/appdata/voidauth/db:/app/db # volume for SQLite file
ports:
- 3099:3000 # may not be needed, depending on reverse-proxy setup
environment:
# Required environment variables
APP_URL: https://auth.DOMAIN.com
STORAGE_KEY: $VOIDAUTH_KEY
DB_ADAPTER: sqlite
SMTP_HOST: smtp.gmail.com
SMTP_FROM: ********
SMTP_PORT: 587
SMTP_SECURE: false
SMTP_USER: *********
SMTP_PASS: *********
networks:
- caddy_net
labels:
caddy: auth.DOMAIN.com
caddy.reverse_proxy: "{{upstreams 3000}}"
networks:
caddy_net:
name: caddy_net

VOIDAUTH OIDC CONFIG:

redirect url: https://grist.DOMAIN.com/oauth2/callback
client_secret_basic
authorization_code, refresh_token
https://grist.DOMAIN.com/signed-out