This is the way. I just hope they don’t start gatekeeping essential features behind the “enterprise” license. Already they have announced push-based 2fa (like Duo) will be enterprise which is a bit of a bummer but it’s honestly awesome software otherwise and beggars can’t be choosers!
This is typically the case. Increasingly, self-hosted apps use integrated OIDC or OAuth but for those that don’t there are various other methods of integration into the SSO provider you’re using including forward auth and remote username. Authentik is nice in that it is also a forward-auth proxy and so you don’t need to use an additional oauth proxy software like oauth2-proxy.
That’s… not how that works. Just because they’re getting separate IP addresses doesn’t mean you can all of the sudden have “full control” and start using privileged ports without granting that sys capability to docker. I fear you are overcomplicating what should be a fairly straightforward process and likely weakening security because you don’t fully grok the implications of the security measures you’re attempting to put in place. Just use traefik or caddy and be done with it.