Traefik ingress (svc-knoe-ingress) routes db.prole.org to service/oauth2-proxy:80 in knoe-system. oauth2-proxy itself runs in supabase namespace, so this ExternalName alias bridges the gap.
