feature request: Support multiple admin console redirect URIs or secondary ADMIN_ENDPOINT for VPN/private network access

What problem did you meet?

I run a self-hosted Logto OSS instance with ADMIN_ENDPOINT set to a public-facing domain (e.g. https://auth-admin.example.com) behind a CDN for caching and DDoS protection.

I want to access the admin console from a private VPN network using a VPN-only hostname without exposing my server's IP address.

The problem: The admin console SPA constructs redirect_uri from window.location.origin. When accessed via the VPN URL, the browser sends: redirect_uri = https://vpn-hostname/console/callback

Logto's OIDC server only accepts redirect URIs derived from ADMIN_ENDPOINT, so the OIDC validation fails with oidc.invalid_redirect_uri.

Header rewriting (nginx X-Forwarded-Host) does not help because redirect_uri is constructed client-side from window.location.origin, not from server headers.

What I tried:

• nginx proxy with Host/X-Forwarded-Host rewriting
• Tailscale sidecar with TS_SERVE_CONFIG
• Management API (admin-console app not exposed)
• Related issues: #6648 (Cloudflare Tunnel), Discussion #6476

What would solve this: Option A: Environment variable for additional allowed redirect URIs: ADMIN_EXTRA_REDIRECT_URIS=https://vpn-hostname

Option B: Make the admin-console app patchable via Management API so redirect URIs can be added directly

Option C: Support for multiple ADMIN_ENDPOINT values (comma-separated)

Thank you for your great product and consideration !

Describe what you'd like Logto to have

I want to access the admin console from a private VPN network using a VPN-only hostname while behind a CDN for caching and DDoS protection.